@oortmem/core 0.3.0 → 0.5.0

package/dist/levels.d.ts

@@ -0,0 +1,79 @@
+import { type Level, type NodeRef } from './address.js';
+import { type Grant } from './grant.js';
+import type { Memory } from './model.js';
+/**
+ * The levels a recall can name in `include` (spec 7.1): `self` is the
+ * caller's home node, `planet` the person's Planet, `star` the calling agent's
+ * own Star, `constellation` and `galaxy` the hive nodes. Always intersected
+ * with the grant.
+ */
+export type IncludeLevel = 'self' | 'planet' | 'star' | 'constellation' | 'galaxy';
+export declare const INCLUDE_LEVELS: readonly IncludeLevel[];
+export declare const isIncludeLevel: (s: string) => s is IncludeLevel;
+/** At most this many hive nodes are read by default (spec 7.1: one recall, a bounded fan-out). */
+export declare const DEFAULT_HIVE_NODES = 4;
+/**
+ * A recall asked for a level its grant does not cover. Typed, so callers tell
+ * "you may not read that" apart from "nothing matched" (spec 7.1).
+ */
+export declare class ScopeDeniedError extends Error {
+    readonly code: 'scope_denied';
+    readonly levels: IncludeLevel[];
+    constructor(levels: IncludeLevel[]);
+}
+/**
+ * The nodes one recall reads: with `include`, every readable node a named
+ * level covers (a level that covers none rejects with `ScopeDeniedError`);
+ * without it, every readable node, hive nodes capped at `DEFAULT_HIVE_NODES`
+ * in grant order. Never a node outside `g`.
+ */
+export declare function nodesToRead(g: Grant, include?: readonly IncludeLevel[]): NodeRef[];
+/**
+ * How specific a node is, for the specificity prior and the conflict rule:
+ * an agent's own memory (Star, Orbit, Flyby) 3, the person's Planet 2, a
+ * Constellation 1, a Galaxy 0. Narrower is higher.
+ */
+export declare function specificity(node: Pick<NodeRef, 'level'> & {
+    hiveId?: string;
+}): number;
+/**
+ * The specificity prior's factor for a node: `1 + ε × specificity / 3`, so
+ * with `ε` the narrowest level gains `ε` and a Galaxy nothing. `ε = 0` (the
+ * default) leaves every score as it was.
+ */
+export declare function specificityFactor(node: NodeRef, epsilon: number): number;
+/** Brackets in memory text, escaped so the text cannot pass for a code-built label. */
+export declare function escapeLabelText(text: string): string;
+/** Where a recalled memory came from, built by code from its address and author. */
+export interface MemoryOrigin {
+    level: Level;
+    /** The space name: Planet, Star, Orbit, Flyby, Constellation or Galaxy. */
+    space: string;
+    /** The node, as a label shows it: `your Planet`, `Star cursor`, `Constellation checkout`. */
+    node: string;
+    /** For people: `from your Planet`, `from this agent's Star`, `from Star cursor`. */
+    from: string;
+    /** The memory lives in the caller's home node. */
+    home: boolean;
+    /** The agent that wrote it. */
+    author: string;
+    /**
+     * A narrower memory in this result contradicts this one (spec 7.2): it ranks
+     * first, and this one stays, labelled.
+     */
+    overriddenBy?: {
+        id: string;
+        node: string;
+    };
+}
+/** The node part of a label for `node`, as the caller of grant `g` sees it. */
+export declare function nodeLabel(node: NodeRef, g: Grant): string;
+/** The origin of `m` for the caller of grant `g`. */
+export declare function originOf(m: Pick<Memory, 'scope' | 'address' | 'author'>, g: Grant): MemoryOrigin;
+/** The decision `observe` records on a memory written instead of editing one in another node. */
+export declare const CONTRADICTS: {
+    readonly stage: 'level';
+    readonly question: 'contradicts';
+};
+/** The ids of memories in other nodes that `m` contradicts (recorded by `observe`). */
+export declare function contradicted(m: Pick<Memory, 'source'>): string[];

package/dist/levels.js

@@ -0,0 +1,140 @@
+import { addressOf, authorOf, GALAXY_ROOT, nodeKey, nodeOf, spaceName, } from './address.js';
+import { readableNodes } from './grant.js';
+export const INCLUDE_LEVELS = Object.freeze([
+    'self',
+    'planet',
+    'star',
+    'constellation',
+    'galaxy',
+]);
+export const isIncludeLevel = (s) => INCLUDE_LEVELS.includes(s);
+/** At most this many hive nodes are read by default (spec 7.1: one recall, a bounded fan-out). */
+export const DEFAULT_HIVE_NODES = 4;
+/**
+ * A recall asked for a level its grant does not cover. Typed, so callers tell
+ * "you may not read that" apart from "nothing matched" (spec 7.1).
+ */
+export class ScopeDeniedError extends Error {
+    code = 'scope_denied';
+    levels;
+    constructor(levels) {
+        super(`scope_denied: this grant cannot read ${levels.join(', ')}`);
+        this.name = 'ScopeDeniedError';
+        this.levels = levels;
+    }
+}
+/** True when `node` is what `level` names for a caller whose grant is `g`. */
+function names(level, node, g) {
+    switch (level) {
+        case 'self':
+            return nodeKey(node) === nodeKey(g.home);
+        case 'planet':
+            return node.level === 'user';
+        case 'star':
+            return (node.level === 'agent' &&
+                node.orgId === g.principal.orgId &&
+                node.agentId === g.principal.agentId);
+        case 'constellation':
+            return node.level === 'hive' && node.hiveId !== GALAXY_ROOT;
+        case 'galaxy':
+            return node.level === 'hive' && node.hiveId === GALAXY_ROOT;
+    }
+}
+/**
+ * The nodes one recall reads: with `include`, every readable node a named
+ * level covers (a level that covers none rejects with `ScopeDeniedError`);
+ * without it, every readable node, hive nodes capped at `DEFAULT_HIVE_NODES`
+ * in grant order. Never a node outside `g`.
+ */
+export function nodesToRead(g, include) {
+    const readable = readableNodes(g);
+    if (include === undefined || include.length === 0) {
+        let hives = 0;
+        return readable.filter((n) => n.level !== 'hive' || ++hives <= DEFAULT_HIVE_NODES);
+    }
+    for (const l of include) {
+        if (!isIncludeLevel(l))
+            throw new RangeError(`unknown level ${JSON.stringify(l)}`);
+    }
+    const denied = [...new Set(include)].filter((l) => !readable.some((n) => names(l, n, g)));
+    if (denied.length > 0)
+        throw new ScopeDeniedError(denied);
+    return readable.filter((n) => include.some((l) => names(l, n, g)));
+}
+/**
+ * How specific a node is, for the specificity prior and the conflict rule:
+ * an agent's own memory (Star, Orbit, Flyby) 3, the person's Planet 2, a
+ * Constellation 1, a Galaxy 0. Narrower is higher.
+ */
+export function specificity(node) {
+    switch (node.level) {
+        case 'agent':
+        case 'agent-user':
+        case 'run':
+            return 3;
+        case 'user':
+            return 2;
+        case 'hive':
+            return node.hiveId === GALAXY_ROOT ? 0 : 1;
+    }
+}
+/**
+ * The specificity prior's factor for a node: `1 + ε × specificity / 3`, so
+ * with `ε` the narrowest level gains `ε` and a Galaxy nothing. `ε = 0` (the
+ * default) leaves every score as it was.
+ */
+export function specificityFactor(node, epsilon) {
+    return 1 + (epsilon * specificity(node)) / 3;
+}
+/** Brackets in memory text, escaped so the text cannot pass for a code-built label. */
+export function escapeLabelText(text) {
+    return text.replace(/[[\]]/g, (c) => `\\${c}`);
+}
+/** An id shown inside a label: control characters dropped, brackets escaped, clipped. */
+function labelId(id) {
+    // oxlint-disable-next-line no-control-regex
+    const clean = escapeLabelText(id.replace(/[\u0000-\u001f\u007f]/g, ''));
+    return clean.length > 40 ? `${clean.slice(0, 39)}…` : clean;
+}
+/** The node part of a label for `node`, as the caller of grant `g` sees it. */
+export function nodeLabel(node, g) {
+    switch (node.level) {
+        case 'user':
+            return node.orgId === g.principal.orgId && node.customerId === g.principal.customerId
+                ? 'your Planet'
+                : 'a Planet';
+        case 'agent':
+            return `Star ${labelId(node.agentId)}`;
+        case 'agent-user':
+            return `Orbit ${labelId(node.agentId)}`;
+        case 'run':
+            return `Flyby ${labelId(node.runId)}`;
+        case 'hive':
+            return node.hiveId === GALAXY_ROOT ? 'Galaxy' : `Constellation ${labelId(node.hiveId)}`;
+    }
+}
+/** The origin of `m` for the caller of grant `g`. */
+export function originOf(m, g) {
+    const node = nodeOf(addressOf(m));
+    const label = nodeLabel(node, g);
+    const ownStar = node.level === 'agent' &&
+        node.orgId === g.principal.orgId &&
+        node.agentId === g.principal.agentId;
+    return {
+        level: node.level,
+        space: spaceName(node),
+        node: label,
+        from: ownStar ? "from this agent's Star" : `from ${label}`,
+        home: nodeKey(node) === nodeKey(g.home),
+        author: authorOf(m).agentId,
+    };
+}
+/** The decision `observe` records on a memory written instead of editing one in another node. */
+export const CONTRADICTS = { stage: 'level', question: 'contradicts' };
+/** The ids of memories in other nodes that `m` contradicts (recorded by `observe`). */
+export function contradicted(m) {
+    return m.source.decisions
+        .filter((d) => d.stage === CONTRADICTS.stage && d.question === CONTRADICTS.question)
+        .map((d) => d.answer);
+}
+//# sourceMappingURL=levels.js.map

package/dist/observe.d.ts

@@ -1,5 +1,6 @@
 import type { DecisionController, Embedder, MemoryStore, MemoryWriter, Observation } from './adapters.js';
 import type { ResolvedConfig } from './config.js';
+import { type Home } from './grant.js';
 import type { Decision, Scope } from './model.js';
 export type MemoryOutcomeKind = 'skipped' | 'reinforced' | 'added' | 'updated' | 'superseded' | 'corrected';
 /** What happened to one memory the turn produced. */
@@ -29,6 +30,14 @@ export interface ObserveDeps {
     now?: Date;
     /** Recorded on `source.harness`; defaults to "unknown". */
     harness?: string;
+    /**
+     * Where new memories land (spec 5.1): the person's Planet (default) or, for an agent configured
+     * as a Star, `scope.agentId`'s own Star. Candidates come from both. A memory is only ever
+     * superseded, corrected or refined in the home node, and an agent whose home is its Star never
+     * writes the Planet at all: a Planet memory it re-observes gets an access record (activation),
+     * never a confirmation or an edit.
+     */
+    home?: Home;
 }
 /**
  * Gate-stage reinforcement match floor. When the gate says "do not store", a

package/dist/observe.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
-import { localGrant } from './grant.js';
+import { addressed, addressOf, nodeKey, nodeOf } from './address.js';
+import { grantWrites, homeAddress, localGrant } from './grant.js';
+import { CONTRADICTS } from './levels.js';
 import { capObservation } from './cap.js';
 import { scrubObservation } from './scrub.js';
 import { checkWriterDate, factInterval, utcOffset } from './temporal.js';
@@ -125,11 +127,30 @@ async function apply(a) {
         if (target === undefined)
             return { outcome: 'skipped' };
         await store.recordAccess(grant, [target.id], now);
-        await confirm(store, grant, target.id, now.toISOString());
+        // Confirming writes the memory: only where this agent may write (a Star agent reinforces a
+        // Planet memory's activation but never edits it).
+        if (grantWrites(grant, target))
+            await confirm(store, grant, target.id, now.toISOString());
         return { outcome: 'reinforced', memoryId: target.id };
     }
     let action = best.action === 'UPDATE' ? 'REFINE' : best.action;
     let prior = action === 'ADD' ? undefined : candidates.find((c) => c.id === best.candidateId);
+    if (prior !== undefined && nodeKey(nodeOf(addressOf(prior))) !== nodeKey(grant.home)) {
+        // The prior lives in another node (the Planet, for an agent writing to its Star, or the
+        // reverse). A write never edits a memory outside its home node: the observation becomes a
+        // memory of its own there. A contradiction is recorded, so recall can rank the narrower of the
+        // two first and label the other (spec 7.2). Reinforcing it (above) stays allowed.
+        decisions.push({
+            stage: 'level',
+            question: 'other-node',
+            answer: 'add-instead',
+            probability: 1,
+        });
+        if (action === 'SUPERSEDE' || action === 'CORRECT') {
+            decisions.push({ ...CONTRADICTS, answer: prior.id, probability: best.probability });
+        }
+        prior = undefined;
+    }
     if (prior !== undefined && (prior.scope.projectId ?? null) !== (scope.projectId ?? null)) {
         // Candidates include global memories. A project's observation must not end or
         // rewrite a fact another scope (every project, for a global one) relies on, so it
@@ -235,6 +256,9 @@ async function apply(a) {
     const base = {
         id,
         scope,
+        // A memory at another level than the Planet carries its address and author.
+        ...(grant.home.level !== 'user' &&
+            addressed(homeAddress(grant, scope.projectId), { agentId: scope.agentId })),
         type: w.type,
         text: w.text,
         stub: w.stub,
@@ -418,7 +442,7 @@ export async function observe(raw, scope, deps) {
     const obs = capObservation(scrubbed.obs);
     const { store, embed, decide, write } = deps;
     const now = deps.now ?? new Date();
-    const grant = localGrant(filterFor(scope));
+    const grant = localGrant(filterFor(scope), deps.home === undefined ? {} : { home: deps.home });
     const g = await decide.gate(obs);
     const text = `${obs.userText}\n${obs.assistantText}`;
     if (g.shouldStore < GATE_THRESHOLD) {

package/dist/recall.d.ts

@@ -1,10 +1,25 @@
 import type { Embedder, MemoryStore, Reranker, ScopeFilter } from './adapters.js';
 import type { ResolvedConfig } from './config.js';
+import { type Grant, type Home } from './grant.js';
+import { type IncludeLevel, type MemoryOrigin } from './levels.js';
 import { type Memory } from './model.js';
 import { type RecallMode } from './temporal.js';
 export interface RecallQuery {
     text: string;
-    scope: ScopeFilter;
+    /**
+     * Who recalls, as a pre-level filter: read with `localGrant(scope, { home })`, the person's
+     * Planet plus this agent's own Star in these projects. Required unless `grant` is given.
+     */
+    scope?: ScopeFilter;
+    /** The grant to read with, instead of one built from `scope` (multi-node grants, tests). */
+    grant?: Grant;
+    /** With `scope`: where this agent's memories land (`star` for an agent configured as a Star). */
+    home?: Home;
+    /**
+     * Which levels to read (spec 7.1), intersected with the grant. A level the grant does not cover
+     * rejects with `ScopeDeniedError`. Default: every node the grant reads.
+     */
+    include?: IncludeLevel[];
     budgetChars?: number;
     /** ISO timestamp: recall what was true then (valid time). Implies `mode: 'as-of'`. */
     asOf?: string;
@@ -44,6 +59,8 @@ export interface RecalledMemory extends Memory {
         /** A volatile fact nobody confirmed within `recall.staleAfterDays`. */
         stale?: true;
     };
+    /** Where it came from: level, node, author, and whether a narrower memory overrides it. */
+    origin?: MemoryOrigin;
 }
 export type Degradation = 'no-embedder' | 'no-reranker' | 'embed-failed' | 'rerank-failed'
 /** The reranker returned no ids: the fused order stands. */
@@ -75,6 +92,8 @@ export interface RecallResult {
     embedSkipped?: 'lexical-confident';
     /** The temporal view this recall read. Always set by `recall`. */
     temporal?: RecallTemporal;
+    /** The nodes this recall read, as labels show them (`your Planet`, `Star cursor`). */
+    read?: string[];
     timings: Record<string, number>;
 }
 export interface RecallDeps {
@@ -107,3 +126,10 @@ export declare function fitForInjection<M extends RecalledMemory>(memories: M[],
     kept: M[];
     lines: string[];
 };
+/**
+ * Memory text with any `<oort-…` or `</oort-…` tag opening written as `&lt;`, so a memory cannot
+ * close the `<oort-memory>` block (or open another) and have what follows read as the prompt.
+ */
+export declare function escapeBlockTags(text: string): string;
+/** The share of an injection budget hive memories may take (spec 7.2). */
+export declare const HIVE_QUOTA = 0.4;

package/dist/recall.js

@@ -1,6 +1,8 @@
 import { activation } from './activation.js';
 import { fuse, isVisible } from './fusion.js';
-import { localGrant } from './grant.js';
+import { addressOf, nodeKey, nodeOf } from './address.js';
+import { assertGrant, grantWrites, localGrant, narrowGrant, } from './grant.js';
+import { contradicted, escapeLabelText, nodeLabel, nodesToRead, originOf, specificity, specificityFactor, } from './levels.js';
 import { scrub } from './scrub.js';
 import { isCurrent } from './model.js';
 import { temporalIntent } from './temporal.js';
@@ -17,8 +19,14 @@ const clock = () => performance.now();
  */
 export async function recall(q, deps) {
     const { store, config } = deps;
-    // The store enforces scope; recall reads and hydrates only inside q.scope.
-    const grant = localGrant(q.scope);
+    const full = grantOf(q);
+    // The nodes to read: the grant intersected with `include` (a level it lacks rejects here,
+    // before anything is read). Recall reads and hydrates only inside them; the store enforces it.
+    const nodes = nodesToRead(full, q.include);
+    const grant = narrowGrant(full, nodes);
+    // First stage per node (spec 7.2), then nodes merged by fused score. One node: today's recall.
+    const legs = nodes.map((n) => ({ node: n, grant: narrowGrant(full, [n]) }));
+    const epsilon = config.recall.specificityPrior;
     const now = deps.now ?? new Date();
     // Scrub once: the query text reaches embedders and rerankers, which may be remote. Temporal
     // words ("on 2 April", "changed over time") pick the view and are not searched for.
@@ -54,14 +62,14 @@ export async function recall(q, deps) {
         prefetched.set(id, m);
         return m;
     };
-    const lexicalP = timed('lexicalMs', () => store.lexical(grant, text, config.recall.lexicalK));
+    const lexicalP = timed('lexicalMs', () => Promise.all(legs.map((l) => store.lexical(l.grant, text, config.recall.lexicalK))));
     // A failed embed must not leave the lexical promise unobserved.
     lexicalP.catch(() => { });
     // Lexical first (CON-57): when the lexical answer is already clear, skip the embedding round
     // trip. Otherwise the lexical search has run while nothing else waited on it.
     let embedSkipped;
     if (deps.embed && config.recall.lexicalFirst) {
-        const first = await lexicalP;
+        const first = byRank(await lexicalP);
         if (await lexicalIsConfident(first, queryTokens, read, now, view)) {
             embedSkipped = 'lexical-confident';
         }
@@ -83,15 +91,24 @@ export async function recall(q, deps) {
         timings['embedMs'] = clock() - t;
     }
     const v = vector;
-    const [lexical, dense] = await Promise.all([
+    let denseFailed = false;
+    const [lexicalLegs, denseLegs] = await Promise.all([
         lexicalP,
         v === undefined
-            ? Promise.resolve([])
-            : timed('denseMs', () => store.dense(grant, v, config.recall.denseK).catch(() => {
-                degraded.push('dense-failed');
+            ? Promise.resolve(legs.map(() => []))
+            : timed('denseMs', () => Promise.all(legs.map((l) => store.dense(l.grant, v, config.recall.denseK).catch(() => {
+                denseFailed = true;
                 return [];
-            })),
+            })))),
     ]);
+    if (denseFailed)
+        degraded.push('dense-failed');
+    // Across nodes, by rank (one node: its own list). Used where one list is needed.
+    const lexical = byRank(lexicalLegs);
+    const dense = byRank(denseLegs);
+    // Ranks are per node: each node's first stage ranks its own memories.
+    const lexicalRank = rankWithin(lexicalLegs);
+    const denseRank = rankWithin(denseLegs);
     // Live rows only: a cold row keeps its text, stub and entities, which is all fusion, the gate
     // and the reranker read. Hydration waits until we know what is returned (CON-47).
     const ids = [...new Set([...lexical, ...dense].map((h) => h.id))];
@@ -101,7 +118,14 @@ export async function recall(q, deps) {
         if (m !== null)
             memories.set(m.id, m);
     const tf = clock();
-    const fused = fuse([lexical, dense], memories, now, { activation: config.activation, view });
+    // Reciprocal rank fusion within each node as before, then the nodes merged by fused score,
+    // each scaled by the specificity prior (off at ε = 0). A stable sort: one node keeps its order.
+    const fused = legs
+        .flatMap((l, i) => fuse([lexicalLegs[i], denseLegs[i]], memories, now, {
+        activation: config.activation,
+        view,
+    }).map((f) => epsilon === 0 ? f : { ...f, score: f.score * specificityFactor(l.node, epsilon) }))
+        .sort((x, y) => y.score - x.score);
     timings['fuseMs'] = clock() - tf;
     const coverage = new Map();
     for (const f of fused) {
@@ -168,13 +192,13 @@ export async function recall(q, deps) {
     };
     const kept = candidates.filter((f) => relevant(f.id));
     const dropped = candidates.length - kept.length;
-    const out = [];
+    let out = [];
     for (const f of kept) {
         const m = memories.get(f.id);
         if (m === undefined)
             continue;
-        const lr = lexical.findIndex((h) => h.id === f.id);
-        const dr = dense.findIndex((h) => h.id === f.id);
+        const lr = lexicalRank.get(f.id) ?? -1;
+        const dr = denseRank.get(f.id) ?? -1;
         const rs = rerankScores.get(f.id);
         const ds = denseScore.get(f.id);
         out.push({
@@ -190,9 +214,13 @@ export async function recall(q, deps) {
                 activation: activation(m.accessLog, m.salience, now, config.activation),
                 hydrated: false,
             },
+            origin: originOf(m, full),
         });
     }
-    let result = view.mode === 'history' ? await withChains(out, read, now, view, queryTokens, config) : out;
+    out = withConflicts(out);
+    let result = view.mode === 'history'
+        ? await withChains(out, full, read, now, view, queryTokens, config)
+        : out;
     for (const m of result) {
         if (isCurrent(m, now) && isStale(m, now, config.recall.staleAfterDays)) {
             m.explanation.stale = true;
@@ -211,6 +239,10 @@ export async function recall(q, deps) {
     result = await Promise.all(result.map(async (m) => {
         if (!touched.has(m.id) || m.tier !== 'cold' || !isCurrent(m, now))
             return m;
+        // Hydrating writes the memory back; a node this caller only reads (the Planet, for a Star
+        // agent) is served from its live row, cold and lexical-only, and left as it is.
+        if (!grantWrites(grant, m))
+            return m;
         try {
             const blob = await store.coldGet(grant, m.id);
             // A lost or torn blob: the memory stays cold, lexical-only.
@@ -264,9 +296,87 @@ export async function recall(q, deps) {
         ...(rerankSkipped !== undefined ? { rerankSkipped } : {}),
         ...(embedSkipped !== undefined ? { embedSkipped } : {}),
         temporal,
+        read: nodes.map((n) => nodeLabel(n, full)),
         timings,
     };
 }
+/** The grant a query reads with: its own, or the local grant for its scope and home. */
+function grantOf(q) {
+    if (q.grant !== undefined) {
+        assertGrant(q.grant);
+        return q.grant;
+    }
+    if (q.scope === undefined)
+        throw new TypeError('recall needs a scope or a grant');
+    return localGrant(q.scope, q.home === undefined ? {} : { home: q.home });
+}
+/**
+ * Per-node hit lists as one list, by rank: every node's first hit, then every node's second, in
+ * node order. With one non-empty node it is exactly that node's list.
+ */
+function byRank(lists) {
+    if (lists.length === 1)
+        return lists[0];
+    const out = [];
+    const seen = new Set();
+    const longest = Math.max(0, ...lists.map((l) => l.length));
+    for (let r = 0; r < longest; r++) {
+        for (const l of lists) {
+            const h = l[r];
+            if (h !== undefined && !seen.has(h.id)) {
+                seen.add(h.id);
+                out.push(h);
+            }
+        }
+    }
+    return out;
+}
+/** Each id's 0-based rank within its own node's list. */
+function rankWithin(lists) {
+    const out = new Map();
+    for (const l of lists) {
+        l.forEach((h, i) => {
+            if (!out.has(h.id))
+                out.set(h.id, i);
+        });
+    }
+    return out;
+}
+const nodeOfMemory = (m) => nodeOf(addressOf(m));
+/**
+ * The conflict rule (spec 7.2), always on: when a returned memory contradicts a returned memory in
+ * another node (recorded by observe as a `level`/`contradicts` decision), the narrower of the two
+ * ranks first and the wider one stays, its origin naming what overrides it. Equally specific: the
+ * memory that recorded the contradiction wins.
+ */
+function withConflicts(out) {
+    const byId = new Map(out.map((m) => [m.id, m]));
+    const list = [...out];
+    for (const m of out) {
+        for (const otherId of contradicted(m)) {
+            const other = byId.get(otherId);
+            if (other === undefined || other === m)
+                continue;
+            const [a, b] = [nodeOfMemory(m), nodeOfMemory(other)];
+            if (nodeKey(a) === nodeKey(b))
+                continue;
+            const [winner, loser] = specificity(b) > specificity(a) ? [other, m] : [m, other];
+            const iw = list.indexOf(winner);
+            const il = list.indexOf(loser);
+            if (iw > il) {
+                list.splice(iw, 1);
+                list.splice(il, 0, winner);
+            }
+            if (loser.origin !== undefined && winner.origin !== undefined) {
+                loser.origin = {
+                    ...loser.origin,
+                    overriddenBy: { id: winner.id, node: winner.origin.node },
+                };
+            }
+        }
+    }
+    return list;
+}
 /** The view a query asks for: explicit options first, else read from the query in code. */
 function viewFor(q, text, now) {
     const at = (iso) => iso ?? now.toISOString();
@@ -305,7 +415,7 @@ const CHAIN_MAX = 8;
  * first-ranked chain first. Corrected versions are skipped (they were never true) but walked
  * through. Versions only the walk found are marked `chain`.
  */
-async function withChains(out, read, now, view, queryTokens, config) {
+async function withChains(out, grantFor, read, now, view, queryTokens, config) {
     const byId = new Map(out.map((m) => [m.id, m]));
     const seen = new Set();
     const result = [];
@@ -341,6 +451,7 @@ async function withChains(out, read, now, view, queryTokens, config) {
                     hydrated: false,
                     chain: true,
                 },
+                origin: originOf(m, grantFor),
             });
         }
     }
@@ -453,20 +564,55 @@ const INJECT_CLOSE = '\n</oort-memory>';
  */
 export function fitForInjection(memories, budgetChars, now = new Date()) {
     let total = INJECT_OPEN.length + INJECT_CLOSE.length;
+    let hive = 0;
     const lines = [];
     const kept = [];
+    // Levels are named only when something comes from outside the reader's home node: a recall of
+    // one node reads exactly as before levels existed.
+    const labelled = memories.some((m) => m.origin !== undefined && !m.origin.home);
     for (const m of memories) {
         const note = m.explanation.stale === true
             ? ` (may be outdated; last confirmed ${age(lastConfirmed(m), now)})`
             : '';
-        const line = `- [${m.type}, ${when(m, now)}] ${scrub(m.text).text}${note}`;
+        const text = scrub(escapeBlockTags(escapeLabelText(m.text))).text;
+        const line = `- [${labelFor(m, labelled, now)}] ${text}${note}`;
         const cost = line.length + (lines.length > 0 ? 1 : 0);
+        // Hive memories (Constellation, Galaxy) take at most HIVE_QUOTA of the budget, so a large team
+        // cannot crowd out the person's own memory: one past it is skipped, not the end of the block.
+        const fromHive = m.origin?.level === 'hive';
+        if (fromHive && hive + cost > HIVE_QUOTA * budgetChars)
+            continue;
         if (total + cost > budgetChars)
             break;
         lines.push(line);
         kept.push(m);
         total += cost;
+        if (fromHive)
+            hive += cost;
     }
     return { kept, lines };
 }
+/**
+ * Memory text with any `<oort-…` or `</oort-…` tag opening written as `&lt;`, so a memory cannot
+ * close the `<oort-memory>` block (or open another) and have what follows read as the prompt.
+ */
+export function escapeBlockTags(text) {
+    return text.replace(/<(?=\s*\/?\s*oort-)/gi, '&lt;');
+}
+/** The share of an injection budget hive memories may take (spec 7.2). */
+export const HIVE_QUOTA = 0.4;
+/**
+ * A memory's label, built by code from structured fields only: `semantic, 2d ago`, or with levels
+ * named `semantic, Star cursor, 5h ago`, and `, overridden by Star cursor` when a narrower memory
+ * in the result contradicts it. Memory text never reaches it (and its brackets are escaped).
+ */
+function labelFor(m, labelled, now) {
+    const parts = [m.type];
+    if (labelled && m.origin !== undefined)
+        parts.push(m.origin.node);
+    parts.push(when(m, now));
+    if (m.origin?.overriddenBy !== undefined)
+        parts.push(`overridden by ${m.origin.overriddenBy.node}`);
+    return parts.join(', ');
+}
 //# sourceMappingURL=recall.js.map