@securecoms/agent-bridge 0.28.1 → 0.29.0

package/dist/memory/embedder/client.d.ts

@@ -16,6 +16,12 @@ export interface Embedder {
     state(): EmbedderState;
     ensureStarted(): void;
     filesPresent(): boolean;
+    /**
+     * Cold-path ruling (2026-10-09): true at once when ready; while preparing, true on the transition to ready and false
+     * on a failure, a stop or after `ms`. False at once in any other state. Never rejects and never starts, connects or
+     * spawns anything itself (the caller runs ensureStarted first).
+     */
+    ready(ms: number): Promise<boolean>;
     embed(text: string, priority: 0 | 1, opts?: {
         signal?: AbortSignal;
     }): Promise<Float32Array>;
@@ -64,12 +70,19 @@ export declare class EmbedderClient implements Embedder {
     private verifyAttempt;
     private fails;
     private closed;
+    /** When this client last sent a job (or connected, if later): the idle-stop test (cold-path ruling 2026-10-09). */
+    private lastActivity;
+    /** ready(ms) waiters: settled on the next transition out of "preparing". */
+    private readonly readyWaiters;
     private readonly m;
     private readonly now;
     private readonly log;
     constructor(o: EmbedderClientOptions);
     /** Pure: the report path reads this, and reading it never starts, connects or spawns anything (plan audit LOW). */
     state(): EmbedderState;
+    /** Cold-path ruling (2026-10-09): see Embedder.ready. Pure like state(): never starts, connects or spawns anything. */
+    ready(ms: number): Promise<boolean>;
+    private settleReady;
     private tcp;
     filesPresent(): boolean;
     private key;
@@ -87,6 +100,13 @@ export declare class EmbedderClient implements Embedder {
     private aclToken;
     private aclOk;
     private fail;
+    /**
+     * Rule 6, cold-path ruling (2026-10-09): the served socket closed. With no job pending and this client's last job (or
+     * its connect, if later) at least the shared idle constant ago, it is the shared embedder's idle stop, which is not a
+     * failure: back to `off`, no `fails++`, no `notBefore`, no unavailable report, so the next turn's ensureStarted starts
+     * it at once. Anything else (a job pending, or recent use) stays a failure with its backoff.
+     */
+    private onServedClose;
     ensureStarted(): void;
     private start;
     /** The embedder's fixed-code status file (exit 3). True when it decided the state. */

package/dist/memory/embedder/protocol.d.ts

@@ -1,6 +1,11 @@
 /** Spec §20 E1.2 to E1.4: newline-delimited JSON frames over the local socket; vectors as base64 little-endian float32. */
 export declare const EMBEDDER_PROTOCOL = 1;
 export declare const MAX_TEXT_BYTES = 8192;
+/**
+ * The shared embedder stops after this long with no job from any bridge (server `idleMs` default). The client uses the
+ * same value to tell that idle stop from a failure (cold-path ruling 2026-10-09): ONE constant, used by both.
+ */
+export declare const EMBEDDER_IDLE_MS: number;
 /**
  * 11b review M4: the longest sealed job line. Worst case for MAX_TEXT_BYTES of text: every byte a control character that
  * JSON escapes as \u00XX (6 bytes) = 49152, plus the frame's other fields (< 100), plus the 24-byte nonce and 16-byte

package/dist/memory/note-frames.d.ts

@@ -8,7 +8,7 @@
  * is ignored.
  */
 /** Spec §8.2, §18.1: content-free refusal classes, the only thing a refusal says. */
-export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store", "budget", "purged"];
+export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store", "budget", "purged", "not_owner_words"];
 export type ReasonClass = (typeof REASON_CLASSES)[number];
 export interface MemoryNoteFrame {
     request_id: string;

package/dist/memory/recall/recall-book.d.ts

@@ -62,8 +62,11 @@ export declare class RecallBook {
     private static readonly IDLE_MS;
     private static readonly TOP_K;
     private static readonly TEXT_MAX_CHARS;
+    /** About 1.5 ms of real opens at the measured ~40 µs per row: the longest a warm holds the event loop. */
+    private static readonly WARM_YIELD_ROWS;
     private readonly caches;
     private readonly entries;
+    /** The warm in flight per conversation: a cold turn awaits the same warm instead of starting a second one. */
     private readonly warming;
     private same;
     private nowMs;
@@ -89,12 +92,18 @@ export declare class RecallBook {
      *     re-read capture.
      */
     warm(conversationId: string): Promise<void>;
+    private warmOnce;
     /**
      * §7.1: compute at ingest. Snapshot the capture FIRST (H2); `receipt`
      * replaces its purge and mode epochs with the ones captured when the turn
      * was received (Task 16 fix H-2), so a purge or a mode change after receipt
-     * refuses too. `timeoutMs` bounds the query embed (the caller passes its turn kind's bound); a cold cache
-     * starts a warm and gives nothing.
+     * refuses too.
+     *
+     * Cold-path ruling (architect, 2026-10-09; §7.1 and §7.3 errata): ONE deadline, start + `timeoutMs` (the caller
+     * passes its turn kind's bound: 600 ms text, 250 ms voice), covers the ready wait, the warm and the query embed
+     * together; no phase has a budget of its own. A cold embedder is started (ensureStarted) and waited for; a cold or
+     * stale cache is warmed and waited for. Past the deadline there is no recall and nothing attaches late: a warm that
+     * outlives it keeps running and may install (warm enforces H2 itself), but this turn gets no entry.
      */
     prepare(p: {
         messageId: string;
@@ -107,6 +116,7 @@ export declare class RecallBook {
             modeEpoch: number;
         };
     }): Promise<void>;
+    private attach;
     /** Q3 + Q6: the entry's own conversation, and its capture still current at delivery. Synchronous (ws flush). */
     deliverable(messageId: string, conversationId: string): readonly RecallItem[] | undefined;
     /**

package/dist/memory/unified/chunk.d.ts

@@ -0,0 +1,12 @@
+export declare const CHUNK_TARGET = 600;
+export declare const CHUNK_CAP = 800;
+export declare const CHUNK_OVERLAP = 100;
+export declare function chunkText(text: string): string[];
+/** M-2 then R-U15, in that order: the whole text is scanned once; any hit drops the whole message. */
+export declare function prepareMessageText(text: string): {
+    ok: true;
+    chunks: string[];
+} | {
+    ok: false;
+    reason: "secret" | "empty";
+};

package/dist/memory/unified/config.d.ts

@@ -0,0 +1,7 @@
+export interface UnifiedPayload {
+    on: boolean;
+    reason?: "off" | "unrecognized";
+    clearGeneration?: number;
+    roomClears: ReadonlyMap<string, number>;
+}
+export declare function parseUnifiedPayloadMemory(raw: unknown): UnifiedPayload;

package/dist/memory/unified/consumer-unified.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Spec section 8.1 step 8, U6: unified memory attaches at delivery to the frame copy only, for a runtime socket that
+ * declared memory_unified and never claimed a harness. The buffer, the sealed runtime_inbox and `inflight` keep the
+ * original, so a re-buffered message carries none to an HTTP or harness consumer. The owner predicate and the owner scope
+ * are re-checked in the source (`BridgeAgent.unifiedForDelivery`) on the ORIGINAL message's frozen authorization (H-4).
+ */
+import type { BridgeMessage } from "../../bridge-agent.js";
+import type { UnifiedFrameItem } from "./read-book.js";
+export declare function withConsumerUnified(out: BridgeMessage, original: BridgeMessage, session: {
+    consumer: "runtime" | "unknown";
+    harnessClaimed?: boolean;
+    unifiedConsumer: boolean;
+}, src: {
+    unifiedForDelivery(m: BridgeMessage): {
+        items: UnifiedFrameItem[];
+        pinnedMore: number;
+    } | undefined;
+}): {
+    message: BridgeMessage;
+    shown: ReadonlySet<number>;
+};

package/dist/memory/unified/escape.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Unified memory (spec \u00A710.3, R-U26, M-4, C-1): the escape the bridge applies to the text it quotes in its own lines
+ * (`Pinned:`, `Forgot:`). The runtime renders every block with its own copy of the same function (parity, plan Task 16),
+ * so this file is self-contained. Line breaks and other control characters become a space (the runtime's CONTROL_CHARS
+ * rule, memory.ts:16) so a quoted text can never open a new line; then the remaining C-1 classes are stripped; then the
+ * text is capped to `max` code points; only then are `"` and `\` backslash-escaped (ruling C21). Capping before the
+ * escape means every backslash in the output comes from a whole pair or a whole `\"`, so the output never ends in an
+ * unpaired backslash that would escape the closing quote. The escaped output can be up to twice `max` long.
+ */
+export declare const ITEM_LINE_MAX = 1000;
+export declare const LABEL_MAX = 80;
+export declare function escapeQuoted(s: string, max: number): string;
+/**
+ * Plan Task 30 (I-4 overruled): the CONTROL_TO_SPACE and C1_STRIP steps of escapeQuoted only, with no quote escaping and
+ * no cap. A migrated 7a note loses its invisible characters and is never refused for them.
+ */
+export declare function stripInvisible(s: string): string;
+/** \u00A710.3 "At ingest": every label field loses its control characters before it is stored. */
+export declare function stripLabelAtIngest(s: string): string;
+export declare function pinnedLine(pin: string): string;
+export declare function forgotLine(text: string): string;
+/** OQ-P2: true for exactly the shapes pinnedLine and forgotLine produce (single line, since the escape removes line breaks). Such a line is never saved as an agent reply. */
+export declare function isBridgeMemoryLine(text: string): boolean;

package/dist/memory/unified/index-key.d.ts

@@ -0,0 +1,8 @@
+export declare const MEMORY_INDEX_INFO = "securecoms/agent-memory-index/v1";
+export declare const QUERY_MACS_MAX = 64;
+export declare function deriveMemoryIndexKey(seed: Uint8Array): Buffer;
+/** HMAC-SHA-256 truncated to 16 bytes. */
+export declare function tokenMac(key: Uint8Array, token: string): Uint8Array;
+export declare function itemTokenMacs(key: Uint8Array, text: string): Uint8Array[];
+/** The query's tokens (stop words dropped) and their L-3 expansions, de-duplicated, capped at `max` MACs. */
+export declare function queryTokenMacs(key: Uint8Array, text: string, max?: number): Uint8Array[];

package/dist/memory/unified/item-book.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Unified memory (spec section 7.7; U9, U11, U16, L-1, R2-L-3): the ONLY caller of SqliteMlsStateStore.insertItems. Steps:
+ * the caller has captured U11 synchronously; here 4 (secret filter on the full text), 5 (chunk), 6 (seal, embed, MAC,
+ * outside the mutex), 7 (commit under the mutex: the trust decision, then one transaction), 8 (idempotent key; owner
+ * replaces reference, never the reverse). Logs are content-free (U17).
+ */
+import type { ItemCapture, ItemKind, ItemSource, ItemTrust, ScopeKind, SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import { type ServiceLog } from "../../service-log.js";
+import type { Embedder } from "../embedder/client.js";
+import type { RankingClient } from "./ranking-client.js";
+export type ItemSkip = "secret" | "empty" | "cleared" | "room_cleared" | "disabled" | "purged" | "duplicate" | "changed" | "pin_cap" | "quota" | "invalid" | "store" | "mode" | "message";
+export interface ItemWriteRequest {
+    scopeKind: ScopeKind;
+    scopeId: string;
+    channelId: string;
+    kind: ItemKind;
+    originId: string;
+    originAt: number;
+    source: ItemSource;
+    trust: ItemTrust;
+    text: string;
+    expect: ItemCapture;
+    sourceRef?: string;
+    vec?: Float32Array | null;
+    vecModelId?: string | null;
+    /** Pins and migrated notes: one item, never chunked. */
+    noChunk?: true;
+    /** Task 30: a migrated source row changed since the marker: replace the item with the same source_ref, same trust. */
+    refresh?: true;
+    /** R-U19, migration only (Task 30). */
+    capExempt?: true;
+    /** Plan audit HIGH-2: embed nothing inline; every part goes pending to ItemReembed (Task 30's migration). */
+    pendingOnly?: true;
+    /** Task 28 (pins): the caller's last W1/W2 re-check, evaluated FIRST inside the memory mutex; a veto writes nothing. */
+    precommit?: () => "mode" | "message" | null;
+}
+export interface ItemBookDeps {
+    store: Pick<SqliteMlsStateStore, "reserveItemIds" | "sealItemRecord" | "sealItemVec" | "insertItems" | "itemByOrigin" | "openItemRecord" | "evictBatch">;
+    embedder: Embedder;
+    modelId: string;
+    indexKey: Uint8Array;
+    exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+    ranking: Pick<RankingClient, "added" | "removed">;
+    /** R-U11: false on win32 while WINDOWS_SEMANTIC_ENABLED is false: no embed job runs. */
+    embedOn: () => boolean;
+    /**
+     * Plan audit HIGH-2: true while any call heartbeat of this OS user is live (the 7b E1.4 pause ItemReembed already
+     * respects). While true the write path embeds nothing inline; every part goes pending.
+     */
+    paused: () => boolean;
+    now?: () => number;
+    log?: ServiceLog;
+}
+export declare class ItemBook {
+    private readonly d;
+    private evicting;
+    constructor(d: ItemBookDeps);
+    private skip;
+    commit(r: ItemWriteRequest): Promise<{
+        ok: true;
+        itemIds: number[];
+    } | {
+        ok: false;
+        reason: ItemSkip;
+    }>;
+    /** A post-commit hot-set notification: a throw is logged (content-free) and swallowed, never turned into a write failure. */
+    private rankingNote;
+    /** H-7: batches of at most EVICT_BATCH_MAX rows, a yield between batches, one loop at a time. */
+    evictLoop(): Promise<void>;
+}

package/dist/memory/unified/item-reembed.d.ts

@@ -0,0 +1,20 @@
+/** Unified memory (spec section 7.7 step 6, 7b section 8): pending items are embedded in the background, 16 per tick, paused during calls, never on Windows (R-U11). */
+import type { SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import type { Embedder } from "../embedder/client.js";
+import { type ServiceLog } from "../../service-log.js";
+import type { RankingClient } from "./ranking-client.js";
+export declare class ItemReembed {
+    private readonly d;
+    private running;
+    constructor(d: {
+        ranking: Pick<RankingClient, "pending" | "added">;
+        store: Pick<SqliteMlsStateStore, "itemCapture" | "sealItemVec" | "updateItemVec">;
+        embedder: Embedder;
+        exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+        modelId: string;
+        paused: () => boolean;
+        embedOn: () => boolean;
+        log?: ServiceLog;
+    });
+    tick(): Promise<number>;
+}

package/dist/memory/unified/migrate.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Unified memory (spec 2026-10-10 section 14.1, section 14.5; R-U12, M-1, L-1, H-5, H-B; plan audit HIGH-1, HIGH-2, M-4):
+ * migrate, per conversation, 7a notes (pins), 7b recall (owner auto items, vectors reused) and OWNER-DM history (reference,
+ * whatever its role) into agent_memory_item, in that order (L-1). Room and person-DM history and agent_memory_fact are never
+ * migrated. Idempotent on the item key. One marker per (source, conversation): a conversation never visited, or
+ * unclassifiable, holds back nobody else's (HIGH-1). Every write is pendingOnly: the migration never embeds (HIGH-2).
+ * At most MIGRATION_BATCH source rows per read, a yield between batches (OQ-P7). Never called on a turn's path.
+ *
+ * U11 (section 14.1 "a clear or purge during migration wins"): the capture is taken once per conversation, before its first
+ * read, and every item of that conversation is checked against it in the insert transaction. The first refusal for a
+ * clear, a room clear, a disable or a purge stops the conversation. A Clear all raises every conversation's history
+ * marker to just past the clear in the store's clear transaction (fix round 1), so no later run re-imports pre-clear
+ * history (a clear keeps history, section 14.4). After a disable or a purge the markers stay, so a later run resumes.
+ */
+import { type SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import { type ServiceLog } from "../../service-log.js";
+import type { ItemBook } from "./item-book.js";
+/** Section 14.5: true while the 7a/7b tables are kept (one release). The release that drops them sets this false (the sweep stops). */
+export declare const OLD_TABLES_PRESENT = true;
+/** OQ-P7: at most this many source rows per read; a yield between reads. */
+export declare const MIGRATION_BATCH = 100;
+export type MigrationClass = {
+    kind: "owner";
+    ownerId: string;
+} | {
+    kind: "excluded";
+} | {
+    kind: "unknown";
+};
+export interface MigrationDeps {
+    store: Pick<SqliteMlsStateStore, "readNotesForMigration" | "readRecallForMigration" | "readHistoryForMigration" | "noteConversationIds" | "recallConversationIds" | "historyConversationIds" | "recallTombstoned" | "migrationMarker" | "setMigrationMarker" | "itemCapture">;
+    items: Pick<ItemBook, "commit">;
+    /**
+     * OQ-P1: "owner" with the owner identity for an owner DM; "excluded" for a conversation persisted as non-DM (M-4:
+     * never migrated, never retried, holds nothing); "unknown" when it cannot be classified now (retried on a later run).
+     */
+    classify: (conversationId: string) => MigrationClass;
+    /** Called after a conversation's notes committed pins (the bridge empties its pin cache under the memory mutex, as Task 28 does). */
+    pinsChanged?: () => Promise<void>;
+    /**
+     * Final review bridge I-3: shutdown. Checked before each conversation, each batch and each slice yield; a run that sees
+     * it stops (an abort, retried by a later run: markers cover only the batches that completed) so close() never waits
+     * on a migration ahead of the MLS drain.
+     */
+    stopping?: () => boolean;
+    log?: ServiceLog;
+}
+export interface MigrationResult {
+    notes: number;
+    recall: number;
+    history: number;
+    /** Conversations: unknown now (retried later), excluded (M-4), stopped by a U11 refusal. */
+    skipped: number;
+    excluded: number;
+    aborted: number;
+    unreadable: number;
+}
+export declare function runMigration(d: MigrationDeps, o?: {
+    only?: string;
+}): Promise<MigrationResult>;
+/** Section 14.5, before anything is served, in ONE transaction (controller ruling C22): the per-source sweep, then the clear-generation check. */
+export declare function reupgradeReconcile(store: Pick<SqliteMlsStateStore, "reupgradeReconcileUnified">): {
+    swept: {
+        notes: number;
+        recall: number;
+    };
+    cleared: number;
+};

package/dist/memory/unified/owner-scope.d.ts

@@ -0,0 +1,48 @@
+import { type AbsenceRecord } from "../recall/membership-purge.js";
+import { type ServiceLog } from "../../service-log.js";
+export interface OwnerFacts {
+    isDm: boolean | undefined;
+    pin: {
+        identityId: string;
+    } | "anomalous" | undefined;
+    member: {
+        is_agent: boolean;
+        is_agent_owner: boolean;
+    } | undefined;
+    rosterKnown: boolean;
+}
+/** A scope id when the channel is a DM whose single pinned human is the agent's owner; null when it is not; "unknown" without a fresh roster or a pin. */
+export declare function ownerScopeFrom(channelId: string, f: OwnerFacts): string | null | "unknown";
+export interface OwnerScopeSweepDeps {
+    /**
+     * The owner-DM scope ids holding items (NUL-safe, CARRY-NUL), and (final review store I-2, bridge half) the scope of each
+     * recorded DM owner, so an owner change is seen on a channel that holds no items too.
+     */
+    scopes(): string[];
+    /**
+     * Final review store I-2 (bridge half; ruling FINAL store I-2): the conversations whose 7a/7b rows a migration may still
+     * read. Each DM among them has its current owner recorded (first sight wins; a different recorded owner is left for
+     * the scope loop to settle with the same two-refresh evidence rule, and its purge raises that channel's markers).
+     */
+    oldTableChannels?(): string[];
+    recordOwner?(channelId: string, ownerIdentityId: string): void;
+    /** Roster facts only: no kill switch, provider or memory-mode input (OQ-P3). `isDm` is the persisted flag (C8). */
+    factsOf(channelId: string): OwnerFacts;
+    absenceOf(scopeId: string): AbsenceRecord | undefined;
+    markAbsent(scopeId: string, now: number): AbsenceRecord;
+    clearAbsence(scopeId: string): void;
+    purge(scopeId: string): Promise<void>;
+    now(): number;
+    /** Shutdown: the sweep stops before the next scope (like MembershipPurgeSweeper). */
+    stopping?(): boolean;
+    log?: ServiceLog;
+}
+export declare class OwnerScopeSweeper {
+    private readonly d;
+    private running;
+    constructor(d: OwnerScopeSweepDeps);
+    sweep(): Promise<{
+        purged: number;
+        frozen: number;
+    }>;
+}

package/dist/memory/unified/pin-rules.d.ts

@@ -0,0 +1,18 @@
+/** H-1: frozen; a pin token on this list needs no owner occurrence. Contents approved under OQ-P6. */
+export declare const FRAMING_WORDS: ReadonlySet<string>;
+/**
+ * C-1 with R2-L-1: NFC first; then keep letters (L), numbers (N), punctuation (P), space separators (Zs), the 14 symbols
+ * `$ % & + = < > ~ ^ | # @ * /`, and combining marks Mn and Mc except the variation selectors (including U+180B-180F). Everything else (Cf, Co,
+ * Cn, Cc, tag characters, bidi controls, zero-width characters, other symbols) is stripped.
+ */
+export declare function allowlistPin(raw: string): string;
+/**
+ * H-1: every pin token not on FRAMING_WORDS must occur, as an exact token, in the owner's current message or in an
+ * owner-trust TYPED item delivered with this turn (the caller passes only COVERAGE_SOURCES texts). No stems, no allowance.
+ */
+export declare function pinCoverage(pinStripped: string, ownerMessage: string, coverTexts: readonly string[]): {
+    ok: true;
+} | {
+    ok: false;
+    uncovered: number;
+};

package/dist/memory/unified/ranking-client.d.ts

@@ -0,0 +1,48 @@
+import { type ServiceLog } from "../../service-log.js";
+import type { FromWorker, OpenedItem, RankQuery, ToWorker, WorkerInit } from "./worker-protocol.js";
+export interface RankingTransport {
+    post(m: ToWorker): void;
+    onMessage(cb: (m: FromWorker) => void): void;
+    onExit(cb: () => void): void;
+    terminate(): Promise<void>;
+}
+export declare function workerTransport(init: WorkerInit, distDir: string): RankingTransport;
+export declare class RankingClient {
+    private readonly d;
+    private t;
+    /** Final review bridge I-2(b): set by close(); no call after it spawns a worker or posts. */
+    private closed;
+    private seq;
+    private readonly waiting;
+    private misses;
+    private hot;
+    constructor(d: {
+        spawn: () => RankingTransport;
+        log?: ServiceLog;
+    });
+    private transport;
+    private ask;
+    query(q: RankQuery, deadlineAt: number): Promise<{
+        items: OpenedItem[];
+        openFailed: number;
+    } | "late" | "failed">;
+    pins(scopeId: string, maxChars: number, deadlineAt: number): Promise<{
+        pins: OpenedItem[];
+        more: number;
+    } | "late" | "failed">;
+    pending(limit: number, deadlineAt: number): Promise<Extract<FromWorker, {
+        type: "pending";
+    }>["rows"] | "late" | "failed">;
+    /**
+     * Final review bridge I-2: hot-set notifications reach a RUNNING worker only. With none running they are no-ops (a worker
+     * spawned later warms from the database, so nothing is lost): a purge, clear or write while memory is off never starts
+     * a resident worker, nothing respawns after close(), and a post that throws never escapes into a committed write's path.
+     */
+    private notify;
+    added(itemIds: number[]): void;
+    removed(itemIds: number[]): void;
+    reset(): void;
+    hotBytes(): number;
+    deadlineMisses(): number;
+    close(): Promise<void>;
+}

package/dist/memory/unified/ranking-core-constants.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Unified memory (spec section 8.1, section 8.5; plan Task 27): the read limits, split out of ranking-core.ts so the
+ * main-thread read path (read-book.ts) never imports the module that holds the SQL (T-33). No imports.
+ */
+export declare const TYPED_ITEMS_MAX = 10;
+export declare const VOICE_ITEMS_MAX = 3;
+export declare const READ_CHARS_MAX = 6000;
+export declare const PINNED_CHARS_MAX = 4000;

package/dist/memory/unified/ranking-core.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Unified memory (spec section 8.1 steps 3 to 6, section 8.3, section 8.5; R-U16 rev2, R-U18, H-7): ranking over a READ-ONLY connection.
+ * Runs inside the ranking worker in production (Task 14) and in-process only in tests and the eval (Task 35).
+ * Every embedded item is hot (int8, one float scale per vector); there is no cold vector path. Keyword MACs boost items
+ * already in the meaning list and are the only candidate source for an item still pending its embed and for the
+ * keyword-only read (no query vector, or warm off: Windows, R-U11). U1-G (architect recall-gate memo, section 4).
+ */
+import type { DatabaseSync } from "node:sqlite";
+import type { FromWorker, ToWorker, WorkerInit } from "./worker-protocol.js";
+export declare const DIMS = 384;
+export declare const OWNER_SCOPE_PRIOR = 0.05;
+export declare const RECENCY_FLOOR = 0.85;
+/** U1-G (C): 0.15 -> 0.05, a holding value until a replaced-fact eval exists (Part 2). The 0.85 floor is unchanged. */
+export declare const RECENCY_SLOPE = 0.05;
+export declare const RRF_K = 60;
+export declare const HOT_TOKEN_MAX_POSTINGS = 5000;
+export declare const LIST_MAX = 50;
+/** U1-G (A): section 8.3's freshness is a tie-break: it orders only fused scores within this of each other (float
+ *  rounding; distinct RRF sums at k = 60 over ranks below 50 differ by far more). */
+export declare const FRESHNESS_TIE_EPSILON = 1e-12;
+/** U1-G (D): hot set slots reserved above the warm count, and the growth factor (was doubling). */
+export declare const HOT_SET_HEADROOM = 1024;
+export declare const HOT_SET_GROWTH = 1.25;
+export { TYPED_ITEMS_MAX, VOICE_ITEMS_MAX, READ_CHARS_MAX, PINNED_CHARS_MAX } from "./ranking-core-constants.js";
+/** section 8.5: max(0.85, 1 - age_days/365 x slope), slope 0.05 (U1-G). `slope` is the plan Task 35 eval override only. */
+export declare function recencyWeight(ageDays: number, slope?: number): number;
+/** U1-G (D): the warm reserve, min(count, N) plus the headroom (never N for every agent). */
+export declare function hotSetReserve(embeddedCount: number): number;
+/** U1-G (D): the capacity a grow to hold `need` slots picks: x1.25, capped at N, at least `need`. Past N (the store's
+ *  eviction lags an insert batch) it steps by the headroom, so a long tail over N never grows one slot at a time. */
+export declare function hotSetGrowth(cap: number, need: number): number;
+/** Packed int8 vectors with a per-vector scale; swap-remove keeps it dense. */
+export declare class HotSet {
+    private cap;
+    private n;
+    private q;
+    private scale;
+    private ids;
+    private at;
+    private scopeOf;
+    private pin;
+    private readonly slotOf;
+    private readonly scopes;
+    private readonly scopeIdx;
+    get size(): number;
+    get capacity(): number;
+    vectorBytes(): number;
+    bytes(): number;
+    /** U1-G (D): sets the capacity to at least `slots` in one allocation (the warm reserve). */
+    reserve(slots: number): void;
+    private grow;
+    /** The old buffers are dropped (unreferenced) as soon as they are copied. */
+    private resize;
+    add(e: {
+        itemId: number;
+        vec: Float32Array;
+        scopeId: string;
+        originAt: number;
+        pinned: boolean;
+    }): void;
+    remove(itemId: number): void;
+    clear(): void;
+    /** section 8.5: sim (int8 dot x scale), meaning threshold, then (sim + prior) x recency; the top `k` by that score. */
+    topK(query: Float32Array, allowed: ReadonlySet<string>, o: {
+        k: number;
+        nowMs: number;
+        ownerScope: string | null;
+        threshold: number;
+        prior?: number;
+        recencySlope?: number;
+    }): Array<{
+        itemId: number;
+        sim: number;
+        score: number;
+    }>;
+}
+export declare class RankingCore {
+    private readonly init;
+    private readonly db;
+    private readonly hot;
+    private readonly stmts;
+    constructor(init: WorkerInit, db: DatabaseSync);
+    /** Prepared once per distinct statement text (the keyword statement varies only with the MAC and scope counts). */
+    private stmt;
+    hotCount(): number;
+    hotCapacity(): number;
+    /** The meaning list a query would fuse (section 8.5 scores, the init's eval overrides applied when set). */
+    meaningScores(vec: Float32Array, scopes: readonly string[], ownerScope: string | null, nowMs: number): Array<{
+        itemId: number;
+        sim: number;
+        score: number;
+    }>;
+    hotBytes(): number;
+    private open;
+    private fields;
+    private row;
+    private addRow;
+    /** section 8.5 warm: one row per read, a yield between rows; returns the hot count. A disabled warm (win32 keyword-only) loads nothing. */
+    warm(): Promise<number>;
+    /** Opens a record; null on any failure or a source_ref mismatch (section 11.3). */
+    private openRecord;
+    private opened;
+    /** H-7: one batched statement, LIMIT 5,001 per MAC inside the allowed scopes; a MAC that fills its limit is skipped. */
+    private keyword;
+    /** section 8.1 step 5: message ids of the newest 50 history turns of the conversation, plus the current message. */
+    private excluded;
+    private rank;
+    private pins;
+    private pending;
+    /**
+     * Final review bridge M-4: `handle` with a per-message catch. A request that throws (a prepare failure, a decode throw)
+     * is answered `failed` instead of becoming an unhandled rejection that kills the worker; a notification that throws is
+     * dropped (a later request still warms from the database). Content-free: the error is never sent or logged.
+     */
+    handleSafe(m: ToWorker): Promise<FromWorker | null>;
+    handle(m: ToWorker): Promise<FromWorker | null>;
+}

package/dist/memory/unified/ranking-inprocess.d.ts

@@ -0,0 +1,3 @@
+import type { RankingTransport } from "./ranking-client.js";
+import type { WorkerInit } from "./worker-protocol.js";
+export declare function inProcessTransport(init: WorkerInit): RankingTransport;

package/dist/memory/unified/ranking-worker.d.ts

@@ -0,0 +1 @@
+export {};