@remnic/core 9.69.45 → 9.69.47

package/src/memory-browse.ts

@@ -0,0 +1,316 @@
+/**
+ * Memory-store browse verbs (issue #2978) — deterministic `ls` / `tree` /
+ * `find` over ONE resolved namespace's memory store, so an agent can see
+ * what exists instead of guessing ids at an opaque search box.
+ *
+ * Scope rules (all existing contracts, no new ones):
+ *   - Every call resolves through the caller's `resolveReadableNamespace`
+ *     (read/write path symmetry) and ONE storage instance — browse never
+ *     enumerates across namespaces.
+ *   - Only the recall corpus is browsable: a path's top segment must be a
+ *     `RECALL_FALLBACK_DIRS` category AND survive
+ *     `isGenericRecallExcludedPath`. Derived stores (`artifacts/`,
+ *     `meetings/` records, wearables day stores, `state/`, ...) are
+ *     indistinguishable from missing paths — `not_found`, never listed.
+ *   - Support-passport private memories are filtered exactly like
+ *     `memoryBrowse` (the paginated list): their names never appear.
+ *   - Output is deterministically sorted (plain code-point order, no
+ *     locale) and entry-capped so a huge store cannot blow the response.
+ *
+ * `ponytail:` the index is rebuilt from `readAllMemories()` per call —
+ * O(corpus) per browse. Fine at agent cadence; swap for a cached directory
+ * index if browsing ever sits on a hot path.
+ */
+
+import { toMemoryPathRel } from "./memory-lifecycle-ledger-utils.js";
+import { normalizeProjectionPreview } from "./memory-projection-format.js";
+import { isGenericRecallExcludedPath } from "./orchestration/generic-recall-paths.js";
+import { isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
+import { RECALL_FALLBACK_DIRS } from "./utils/category-dir.js";
+import type { MemoryFile } from "./types.js";
+
+/** Browse reads touch only these storage members. */
+export interface MemoryBrowseStorage {
+  readonly dir: string;
+  readAllMemories(): Promise<MemoryFile[]>;
+}
+
+/** Injected seams; the service supplies live wiring, tests supply doubles. */
+export interface MemoryBrowseDeps {
+  readonly resolveReadableNamespace: (namespace: string | undefined, principal?: string) => string;
+  readonly getStorage: (namespace: string) => Promise<MemoryBrowseStorage>;
+}
+
+export type BrowseVerb = "ls" | "tree" | "find";
+
+export interface MemoryStoreBrowseRequest {
+  readonly verb: BrowseVerb;
+  /** ls/tree: directory relative to the store root ("" or "/" = root). */
+  readonly path?: string;
+  /** tree: expansion depth, 1..MAX_TREE_DEPTH (default 1). */
+  readonly depth?: number;
+  /** find: glob (`*` wildcard) or substring matched against path and name. */
+  readonly pattern?: string;
+  readonly namespace?: string;
+  readonly authenticatedPrincipal?: string;
+}
+
+export interface MemoryBrowseEntry {
+  /** Store-relative path with forward slashes; dirs carry no trailing slash. */
+  readonly path: string;
+  readonly kind: "dir" | "file";
+  readonly name: string;
+  /** Files: first content line (180-char preview). Dirs: empty. */
+  readonly description: string;
+  /** Dirs: recursive memory count beneath. Files: 1. */
+  readonly count: number;
+  /** 0-based depth relative to the browse root (tree nests; ls/find are 0). */
+  readonly depth: number;
+}
+
+export type MemoryBrowseError = "invalid_path" | "not_found" | "invalid_depth" | "invalid_pattern";
+
+export type MemoryStoreBrowseResult =
+  | {
+      ok: true;
+      verb: BrowseVerb;
+      namespace: string;
+      path: string;
+      total: number;
+      entries: MemoryBrowseEntry[];
+      truncated: boolean;
+      rendered: string;
+    }
+  | {
+      ok: false;
+      verb: BrowseVerb;
+      path: string;
+      error: MemoryBrowseError;
+      message: string;
+      rendered: string;
+    };
+
+export const MAX_LS_ENTRIES = 200;
+export const MAX_TREE_ENTRIES = 400;
+export const MAX_TREE_DEPTH = 4;
+export const MAX_FIND_ENTRIES = 200;
+const MAX_PATH_CHARS = 512;
+const MAX_PATTERN_CHARS = 256;
+
+const BROWSABLE_ROOTS: Record<string, true> = Object.fromEntries(RECALL_FALLBACK_DIRS.map((dir) => [dir, true]));
+
+/** The recall-corpus visibility rule shared by every browse code path. */
+function isBrowsableMemoryPath(relPath: string): boolean {
+  if (!relPath.endsWith(".md")) return false;
+  const top = relPath.split("/")[0] ?? "";
+  return BROWSABLE_ROOTS[top] === true && !isGenericRecallExcludedPath(relPath);
+}
+
+/**
+ * Normalize a caller-supplied store path. Returns "" for the root. Throws
+ * `Error` on absolute paths, `..`/`.` segments, backslashes, control
+ * characters, or oversize input — never reinterpreted (pattern 39).
+ */
+export function sanitizeBrowsePath(raw: string | undefined): string {
+  const trimmed = (raw ?? "").trim();
+  if (trimmed === "" || trimmed === "/") return "";
+  if (trimmed.length > MAX_PATH_CHARS) throw new Error("path is too long");
+  if (trimmed.includes("\\")) throw new Error("path must use '/' separators");
+  const segments = trimmed.split("/");
+  for (const segment of segments) {
+    if (segment === "") throw new Error("path has an empty segment");
+    if (segment === "." || segment === "..") throw new Error("path must not contain '.' or '..' segments");
+    for (const ch of segment) {
+      const code = ch.charCodeAt(0);
+      if (code < 0x20 || code === 0x7f) throw new Error("path has control characters");
+    }
+  }
+  return segments.join("/");
+}
+
+/** Escape every regex metacharacter in a glob segment. */
+function segmentRegex(segment: string): RegExp {
+  const source = `^${segment.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`;
+  return new RegExp(source, "i");
+}
+
+/**
+ * `*` glob (one segment per pattern segment, `find -name` semantics — `*`
+ * never crosses `/`) or case-insensitive substring over path and name.
+ */
+export function browsePatternMatches(pattern: string, relPath: string): boolean {
+  const segments = relPath.split("/");
+  const name = segments[segments.length - 1] ?? "";
+  const patternSegments = pattern.split("/");
+  if (patternSegments.length === 1) {
+    const single = patternSegments[0]!;
+    if (single.includes("*")) return segmentRegex(single).test(name);
+    const needle = single.toLowerCase();
+    return relPath.toLowerCase().includes(needle) || name.toLowerCase().includes(needle);
+  }
+  if (patternSegments.length !== segments.length) return false;
+  return patternSegments.every((segment, index) => segmentRegex(segment).test(segments[index]!));
+}
+
+interface DirNode {
+  readonly subdirs: Map<string, DirNode>;
+  readonly files: Map<string, MemoryFile>;
+  count: number;
+}
+
+function emptyNode(): DirNode {
+  return { subdirs: new Map(), files: new Map(), count: 0 };
+}
+
+/** Directory index over the browsable corpus: root "" holds category dirs. */
+function buildIndex(memories: readonly MemoryFile[], dir: string): DirNode {
+  const root = emptyNode();
+  for (const memory of memories) {
+    const rel = toMemoryPathRel(dir, memory.path);
+    if (!isBrowsableMemoryPath(rel)) continue;
+    const segments = rel.split("/");
+    let node = root;
+    node.count += 1;
+    for (let index = 0; index < segments.length - 1; index += 1) {
+      const name = segments[index]!;
+      let child = node.subdirs.get(name);
+      if (child === undefined) {
+        child = emptyNode();
+        node.subdirs.set(name, child);
+      }
+      node = child;
+      node.count += 1;
+    }
+    node.files.set(segments[segments.length - 1]!, memory);
+  }
+  return root;
+}
+
+function byPath(left: { path: string }, right: { path: string }): number {
+  return left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+}
+
+function dirEntries(node: DirNode, dirPath: string): MemoryBrowseEntry[] {
+  const prefix = dirPath === "" ? "" : `${dirPath}/`;
+  const entries: MemoryBrowseEntry[] = [];
+  for (const [name, child] of node.subdirs) {
+    entries.push({ path: `${prefix}${name}`, kind: "dir", name, description: "", count: child.count, depth: 0 });
+  }
+  for (const [name, memory] of node.files) {
+    entries.push({
+      path: `${prefix}${name}`,
+      kind: "file",
+      name,
+      description: normalizeProjectionPreview(memory.content),
+      count: 1,
+      depth: 0,
+    });
+  }
+  return entries.sort(byPath);
+}
+
+function renderEntries(verb: BrowseVerb, namespace: string, browsePath: string, entries: readonly MemoryBrowseEntry[]): string {
+  const lines = [`${verb} ${namespace}:${browsePath === "" ? "/" : browsePath}`];
+  for (const entry of entries) {
+    const indent = "  ".repeat(entry.depth);
+    if (entry.kind === "dir") {
+      lines.push(`${indent}${entry.path}/ (${entry.count} memories)`);
+    } else {
+      const description = entry.description.length > 0 ? ` — ${entry.description}` : "";
+      lines.push(`${indent}${entry.path}${description}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+function refusal(verb: BrowseVerb, browsePath: string, error: MemoryBrowseError, message: string): MemoryStoreBrowseResult {
+  return { ok: false, verb, path: browsePath, error, message, rendered: `browse ${verb} failed: ${error} — ${message}` };
+}
+
+/** Run one browse verb. Malformed input throws `Error`; typed refusals return in-band. */
+export async function runMemoryBrowse(
+  deps: MemoryBrowseDeps,
+  request: MemoryStoreBrowseRequest,
+): Promise<MemoryStoreBrowseResult> {
+  const namespace = deps.resolveReadableNamespace(request.namespace, request.authenticatedPrincipal);
+  const storage = await deps.getStorage(namespace);
+  const memories = (await storage.readAllMemories()).filter((memory) => !isSupportPassportPrivateMemory(memory));
+
+  if (request.verb === "find") {
+    const pattern = (request.pattern ?? "").trim();
+    if (pattern.length === 0) return refusal(request.verb, "", "invalid_pattern", "pattern is required");
+    if (pattern.length > MAX_PATTERN_CHARS) {
+      return refusal(request.verb, "", "invalid_pattern", "pattern is too long");
+    }
+    const hits: MemoryBrowseEntry[] = [];
+    let truncated = false;
+    let total = 0;
+    for (const memory of memories) {
+      const rel = toMemoryPathRel(storage.dir, memory.path);
+      if (!isBrowsableMemoryPath(rel)) continue;
+      if (!browsePatternMatches(pattern, rel)) continue;
+      total += 1;
+      if (hits.length >= MAX_FIND_ENTRIES) {
+        truncated = true;
+        break;
+      }
+      hits.push({
+        path: rel,
+        kind: "file",
+        name: rel.split("/").pop() ?? rel,
+        description: normalizeProjectionPreview(memory.content),
+        count: 1,
+        depth: 0,
+      });
+    }
+    hits.sort(byPath);
+    return { ok: true, verb: "find", namespace, path: "", total, entries: hits, truncated, rendered: renderEntries("find", namespace, "", hits) };
+  }
+
+  let browsePath: string;
+  try {
+    browsePath = sanitizeBrowsePath(request.path);
+  } catch (err) {
+    return refusal(request.verb, request.path ?? "", "invalid_path", err instanceof Error ? err.message : String(err));
+  }
+  const root = buildIndex(memories, storage.dir);
+  let node: DirNode | undefined = root;
+  for (const segment of browsePath === "" ? [] : browsePath.split("/")) {
+    node = node?.subdirs.get(segment);
+    if (node === undefined) break;
+  }
+  // Invisible-by-design stores resolve as not_found, indistinguishable from
+  // a missing path: the index only ever contains browsable corpus paths.
+  if (node === undefined) {
+    return refusal(request.verb, browsePath, "not_found", `no browsable store path: ${browsePath}`);
+  }
+
+  if (request.verb === "ls") {
+    const all = dirEntries(node, browsePath);
+    const truncated = all.length > MAX_LS_ENTRIES;
+    const entries = all.slice(0, MAX_LS_ENTRIES);
+    return { ok: true, verb: "ls", namespace, path: browsePath, total: all.length, entries, truncated, rendered: renderEntries("ls", namespace, browsePath, entries) };
+  }
+
+  if (request.depth !== undefined && (!Number.isInteger(request.depth) || request.depth < 1 || request.depth > MAX_TREE_DEPTH)) {
+    return refusal(request.verb, browsePath, "invalid_depth", `depth must be an integer between 1 and ${MAX_TREE_DEPTH}`);
+  }
+  const depth = request.depth ?? 1;
+  const entries: MemoryBrowseEntry[] = [];
+  let truncated = false;
+  const walk = (current: DirNode, currentPath: string, currentDepth: number): void => {
+    for (const entry of dirEntries(current, currentPath)) {
+      if (entries.length >= MAX_TREE_ENTRIES) {
+        truncated = true;
+        return;
+      }
+      entries.push({ ...entry, depth: currentDepth });
+      if (entry.kind === "dir" && currentDepth < depth - 1) {
+        walk(current.subdirs.get(entry.name)!, entry.path, currentDepth + 1);
+        if (truncated) return;
+      }
+    }
+  };
+  walk(node, browsePath, 0);
+  return { ok: true, verb: "tree", namespace, path: browsePath, total: entries.length, entries, truncated, rendered: renderEntries("tree", namespace, browsePath, entries) };
+}

package/src/orchestration/recall-search-pipeline.test.ts

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import os from "node:os";
 import path from "node:path";
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, utimes, writeFile } from "node:fs/promises";
 import test from "node:test";
 
 import { parseConfig } from "../config.js";
@@ -565,3 +565,209 @@ test("QMD stops after an underfilled archive-only page", async () => {
   assert.deepEqual(out, []);
   assert.equal(searchCalls, 1, "an underfilled raw page must not trigger widening");
 });
+
+// ─── #2976: memory age from content dates; bulk-touch mtime distrust ─────────
+
+const AGE_DAY_MS = 86_400_000;
+
+function scoredResult(namespace: string, p: string, score: number): QmdSearchResult {
+  return { docid: `${namespace}:${p}`, namespace, path: p, score, snippet: p };
+}
+
+function ageMemory(absPath: string, frontmatter: Record<string, unknown>): MemoryFile {
+  return {
+    path: absPath,
+    content: absPath,
+    frontmatter: { status: "active", memoryKind: "fact", ...frontmatter } as unknown as MemoryFile["frontmatter"],
+  };
+}
+
+function boostCoordinator(
+  memoryDir: string,
+  recencyWeight: number,
+): RecallSearchPipelineCoordinator {
+  const config = parseConfig({
+    openaiApiKey: "sk-test",
+    memoryDir,
+    workspaceDir: path.join(memoryDir, "workspace"),
+  });
+  const deps = {
+    config,
+    effectiveRecencyWeight: () => recencyWeight,
+    filterSearchResultsForRecall: async (
+      results: QmdSearchResult[],
+      preloaded?: Map<string, MemoryFile>,
+    ) => ({ results, memoryByPath: preloaded ?? new Map() }),
+  } as unknown as RecallSearchPipelineDeps;
+  return new RecallSearchPipelineCoordinator(deps);
+}
+
+async function writeDatedFile(filePath: string, mtimeMs: number): Promise<void> {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, "fixture\n");
+  await utimes(filePath, mtimeMs / 1000, mtimeMs / 1000);
+}
+
+function isoAgo(now: number, days: number): string {
+  return new Date(now - days * AGE_DAY_MS).toISOString();
+}
+
+test("#2976 content dates age a memory even when its mtime is fresh (updated backs a missing created)", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-age-content-"));
+  try {
+    const now = Date.now();
+    const fileA = path.join(memoryDir, "facts", "a.md");
+    const fileB = path.join(memoryDir, "facts", "b.md");
+    // Both files carry today's mtime — the bulk import / cp -r shape. A has
+    // no created, only a 40-day-old updated; B carries a 40-day-old created.
+    await writeDatedFile(fileA, now);
+    await writeDatedFile(fileB, now);
+    const memoryByPath = new Map<string, MemoryFile>([
+      ["default\0facts/a.md", ageMemory(fileA, { updated: isoAgo(now, 40) })],
+      ["default\0facts/b.md", ageMemory(fileB, { created: isoAgo(now, 40), updated: isoAgo(now, 40) })],
+    ]);
+
+    const boosted = await boostCoordinator(memoryDir, 0.5).boostSearchResults(
+      [scoredResult("default", "facts/a.md", 1), scoredResult("default", "facts/b.md", 1)],
+      ["default"],
+      undefined,
+      memoryByPath,
+    );
+
+    const [a, b] = boosted;
+    const expected = 1 * 0.5 + Math.pow(0.5, 40 / 7) * 0.5;
+    assert.ok(a && Number.isFinite(a.score), "a memory without created must not score NaN");
+    assert.ok(b && Number.isFinite(b.score));
+    assert.ok(Math.abs(a.score - expected) < 1e-9, `ages by the 40-day-old content date (${a?.score}), not the fresh mtime (1.0)`);
+    assert.equal(a.score, b.score, "updated and created of the same age produce the same score");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("#2976 a bulk-touch mtime cluster never inflates freshness (ranking unchanged vs pre-touch base order)", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-age-bulk-"));
+  try {
+    const now = Date.now();
+    const files = ["facts/x.md", "facts/y.md", "facts/z.md"];
+    const baseScores = [0.9, 0.8, 0.7];
+    const mtimes = [now - 10 * AGE_DAY_MS, now - 30 * AGE_DAY_MS, now - 90 * AGE_DAY_MS];
+    // Undated memories: only mtime can say how old they are.
+    const buildMap = () =>
+      new Map<string, MemoryFile>(
+        files.map((rel) => ["default\0" + rel, ageMemory(path.join(memoryDir, rel), {})]),
+      );
+    for (let i = 0; i < files.length; i += 1) {
+      await writeDatedFile(path.join(memoryDir, files[i]!), mtimes[i]!);
+    }
+    const results = () => files.map((rel, i) => scoredResult("default", rel, baseScores[i]!));
+
+    // Pre-touch: mtimes are scattered, so each trusted mtime ages its memory.
+    const preTouch = await boostCoordinator(memoryDir, 0.5).boostSearchResults(
+      results(),
+      ["default"],
+      undefined,
+      buildMap(),
+    );
+    for (const r of preTouch) {
+      assert.ok(Number.isFinite(r.score), "an undated memory with a trusted mtime must not score NaN");
+    }
+    assert.deepEqual(
+      preTouch.map((r) => r.path),
+      ["facts/x.md", "facts/y.md", "facts/z.md"],
+      "pre-touch, the scattered trusted mtimes preserve the base ranking",
+    );
+
+    // Bulk touch: every mtime reset to one calendar day (cp -r / restore).
+    const bulkDay = now - 1 * AGE_DAY_MS;
+    for (const rel of files) {
+      await writeDatedFile(path.join(memoryDir, rel), bulkDay);
+    }
+    const postTouch = await boostCoordinator(memoryDir, 0.5).boostSearchResults(
+      results(),
+      ["default"],
+      undefined,
+      buildMap(),
+    );
+    assert.deepEqual(
+      postTouch.map((r) => r.score),
+      baseScores,
+      "a same-day mtime cluster is distrusted: no recency boost, scores stay at base",
+    );
+    assert.deepEqual(
+      postTouch.map((r) => r.path),
+      ["facts/x.md", "facts/y.md", "facts/z.md"],
+      "ranking is unchanged versus the pre-touch base order",
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("#2976 an undated memory falls back to a trusted scattered mtime; a dated sibling keeps its content age", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-age-fallback-"));
+  try {
+    const now = Date.now();
+    const fileA = path.join(memoryDir, "facts", "undated.md");
+    const fileB = path.join(memoryDir, "facts", "dated.md");
+    // A: no dates, mtime 2 days ago. B: created 2 days ago, mtime 5 days ago
+    // (different days, one file each — no cluster, mtime stays trusted).
+    await writeDatedFile(fileA, now - 2 * AGE_DAY_MS);
+    await writeDatedFile(fileB, now - 5 * AGE_DAY_MS);
+    const memoryByPath = new Map<string, MemoryFile>([
+      ["default\0facts/undated.md", ageMemory(fileA, {})],
+      ["default\0facts/dated.md", ageMemory(fileB, { created: isoAgo(now, 2), updated: isoAgo(now, 2) })],
+    ]);
+
+    const boosted = await boostCoordinator(memoryDir, 0.5).boostSearchResults(
+      [scoredResult("default", "facts/undated.md", 1), scoredResult("default", "facts/dated.md", 1)],
+      ["default"],
+      undefined,
+      memoryByPath,
+    );
+
+    const [undated, dated] = boosted;
+    // 1e-6 (not 1e-9): the pipeline stamps its own Date.now() after this
+    // test's fixture writes, so a few ms of clock drift shifts the 2-day
+    // blend in the 8th decimal.
+    const expected = 1 * 0.5 + Math.pow(0.5, 2 / 7) * 0.5;
+    assert.ok(undated && Number.isFinite(undated.score), "the undated memory must not score NaN");
+    assert.ok(
+      undated && Math.abs(undated.score - expected) < 1e-6,
+      `an undated memory ages by its trusted mtime (2 days): got ${undated?.score}, want ~${expected}`,
+    );
+    assert.ok(
+      undated && dated && Math.abs(undated.score - dated.score) < 1e-6,
+      "mtime fallback and a same-aged content date score identically",
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("#2976 guard: a memory whose content date is older than its fresh mtime ages by the content date", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-age-guard-"));
+  try {
+    const now = Date.now();
+    const filePath = path.join(memoryDir, "facts", "old.md");
+    await writeDatedFile(filePath, now); // fresh mtime, 90-day-old content
+    const memoryByPath = new Map<string, MemoryFile>([
+      ["default\0facts/old.md", ageMemory(filePath, { created: isoAgo(now, 90), updated: isoAgo(now, 90) })],
+    ]);
+
+    const boosted = await boostCoordinator(memoryDir, 0.5).boostSearchResults(
+      [scoredResult("default", "facts/old.md", 1)],
+      ["default"],
+      undefined,
+      memoryByPath,
+    );
+
+    const expected = 1 * 0.5 + Math.pow(0.5, 90 / 7) * 0.5;
+    assert.ok(
+      boosted[0] && Math.abs(boosted[0].score - expected) < 1e-9,
+      "ages by the 90-day-old created date, not the fresh mtime",
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/orchestration/recall-search-pipeline.ts

@@ -34,6 +34,7 @@ import { RerankCache, rerankLocalOrNoop, reorderByRankedKeys } from "../rerank.j
 import type { SearchBackend, SearchDegradation, SearchExecutionOptions, SearchQueryOptions } from "../search/port.js";
 import { SecureStoreLockedError } from "../secure-store/index.js";
 import { isPathInsideStorageRoot } from "../storage-paths.js";
+import { applyRecencyBoost, collectMtimeFallbackContext } from "../memory-age.js";
 import type { CorpusReadOptions } from "../corpus-read-cancellation.js";
 import { extractTagsFromPrompt, isTemporalQuery, queryByDateRangeAsync, queryByTagsAsync, readIndexSnapshotAsync, recencyWindowFromPrompt } from "../temporal-index.js";
 import {
@@ -1558,20 +1559,23 @@ export class RecallSearchPipelineCoordinator {
 
     const boosted: QmdSearchResult[] = [];
     const recencyWeight = this.deps.effectiveRecencyWeight();
+    // #2976: mtime backs age only for memories without content dates, and a
+    // same-day mtime cluster (bulk import / restore / cp -r) is distrusted.
+    const mtimeFallback =
+      recencyWeight > 0
+        ? await collectMtimeFallbackContext(
+            safeResults.flatMap((r) => { const m = memoryForResult(memoryByPath, r); return m ? [m] : []; }),
+          )
+        : null;
     for (const r of safeResults) {
       const memory = memoryForResult(memoryByPath, r);
       let score = r.score;
 
       if (memory) {
-        // Recency boost: exponential decay over 7 days
-        if (recencyWeight > 0) {
-          const createdAt = new Date(memory.frontmatter.created).getTime();
-          const ageMs = now - createdAt;
-          const ageDays = ageMs / (1000 * 60 * 60 * 24);
-          const halfLifeDays = 7;
-          const recencyScore = Math.pow(0.5, ageDays / halfLifeDays);
-          score = score * (1 - recencyWeight) + recencyScore * recencyWeight;
-        }
+        // Recency boost: 7-day exponential decay over the shared age resolver
+        // (#2976): content dates first, trusted mtime as fallback, unknown
+        // age never fresh. See memory-age.ts.
+        score = applyRecencyBoost(score, memory, recencyWeight, now, mtimeFallback);
 
         // Access count boost: log scale, capped
         if (this.deps.config.boostAccessCount && memory.frontmatter.accessCount) {

package/src/orchestration/semantic-merge-commit-effects.ts

@@ -13,6 +13,7 @@
  */
 
 import { GraphEdgeAppendError } from "../graph-append-error.js";
+import type { CasRevisionReadStatus } from "../storage/cas-revision-store.js";
 import type { GraphEdge, GraphType } from "../graph.js";
 import { readFile } from "node:fs/promises";
 import { removeNodeEdgesForRewrite, rollbackNodeEdgeRewrite } from "../graph-jsonl.js";
@@ -259,8 +260,8 @@ export async function persistMergedTargetThreadEpisode(
 }
 
 /**
- * Round N+12 (C) + N+14: replace a merged target's generated graph edges
- * with the rebuild's rows, revision-guarded end to end. The caller's
+ * Round N+12 (C) + N+14 + #2837: replace a merged target's generated graph
+ * edges with the rebuild's rows, revision-guarded end to end. The caller's
  * committed-body check can pass, writer B can then commit a NEWER merge and
  * finish rebuilding edges for it, and writer A would resume to remove B's
  * edges and install edges derived from A's older body. The revision observed
@@ -271,6 +272,15 @@ export async function persistMergedTargetThreadEpisode(
  * chain only then). A build failure rolls back the same way (round N+10 C)
  * and rethrows — fail-open stays the caller's decision.
  *
+ * #2837: the post-build guard reads the truthful receipt STATUS, never the
+ * fail-open token. The old guard collapsed an unreadable sidecar into
+ * undefined on both reads, so an unavailable-vs-unavailable rewrite compared
+ * undefined against undefined, passed, and installed replacement edges no
+ * receipt ever verified. An `unavailable` post-build status now aborts the
+ * install (rollback, false) so the next merge retries; only a PROVEN match —
+ * present-and-equal, or absent-against-absent for a pre-sidecar target —
+ * may install.
+ *
  * Round N+14 makes the ROLLBACK surgical: `build` returns the exact rows it
  * appended (by identity), and the rollback removes only those — never a
  * node-wide sweep — so rows a newer writer appended after this writer's
@@ -283,13 +293,14 @@ export async function rewriteMergedTargetGraphEdges(
   storage: {
     dir: string;
     getMemoryByIdIncludingArchived: (id: string) => Promise<MemoryFile | null>;
-    readCasRevision: (filePath: string) => Promise<string | undefined>;
+    readCasRevisionStatus: (filePath: string) => Promise<CasRevisionReadStatus>;
   },
   input: {
     targetId: string;
     memoryRelPath: string;
     mergedContent: string;
-    /** The CAS revision token the committed-body check observed. */
+    /** The CAS revision token the committed-body check observed (undefined
+     * only when the check PROVED the receipt absent — #2837). */
     revisionChecked: string | undefined;
     rewriteTypes: readonly GraphType[];
     build: () => Promise<GraphEdge[] | void>;
@@ -306,15 +317,26 @@ export async function rewriteMergedTargetGraphEdges(
   try {
     appended = (await input.build()) ?? undefined;
     const committedNow = await storage.getMemoryByIdIncludingArchived(input.targetId);
-    const committedRevision = committedNow === null ? undefined : await storage.readCasRevision(committedNow.path).catch((err) => {
-      log.warn(`rewriteMergedTargetGraphEdges: failed to read CAS revision for ${committedNow.path}: ${err}`);
-      return undefined;
-    });
+    let standing: CasRevisionReadStatus;
+    if (committedNow === null) {
+      standing = { status: "absent" };
+    } else {
+      standing = await storage.readCasRevisionStatus(committedNow.path).catch((err: unknown) => ({
+        status: "unavailable" as const,
+        reason: err instanceof Error ? err.message : String(err),
+      }));
+    }
     if (
       !committedNow ||
       committedNow.content !== input.mergedContent ||
-      committedRevision !== input.revisionChecked
+      standing.status === "unavailable" ||
+      (standing.status === "present" ? standing.revision : undefined) !== input.revisionChecked
     ) {
+      if (standing.status === "unavailable") {
+        log.warn(
+          `rewriteMergedTargetGraphEdges: CAS revision status for ${input.memoryRelPath} is unavailable (${standing.reason}); aborting the install — an unverified replacement must not install (#2837)`,
+        );
+      }
       await rollbackNodeEdgeRewrite(storage.dir, input.memoryRelPath, input.rewriteTypes, removedEdges, input.targetId, appended);
       return false;
     }