@securecoms/agent-bridge 0.28.2 → 0.29.0

package/dist/memory/note-frames.d.ts

@@ -8,7 +8,7 @@
  * is ignored.
  */
 /** Spec §8.2, §18.1: content-free refusal classes, the only thing a refusal says. */
-export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store", "budget", "purged"];
+export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store", "budget", "purged", "not_owner_words"];
 export type ReasonClass = (typeof REASON_CLASSES)[number];
 export interface MemoryNoteFrame {
     request_id: string;

package/dist/memory/unified/chunk.d.ts

@@ -0,0 +1,12 @@
+export declare const CHUNK_TARGET = 600;
+export declare const CHUNK_CAP = 800;
+export declare const CHUNK_OVERLAP = 100;
+export declare function chunkText(text: string): string[];
+/** M-2 then R-U15, in that order: the whole text is scanned once; any hit drops the whole message. */
+export declare function prepareMessageText(text: string): {
+    ok: true;
+    chunks: string[];
+} | {
+    ok: false;
+    reason: "secret" | "empty";
+};

package/dist/memory/unified/config.d.ts

@@ -0,0 +1,7 @@
+export interface UnifiedPayload {
+    on: boolean;
+    reason?: "off" | "unrecognized";
+    clearGeneration?: number;
+    roomClears: ReadonlyMap<string, number>;
+}
+export declare function parseUnifiedPayloadMemory(raw: unknown): UnifiedPayload;

package/dist/memory/unified/consumer-unified.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Spec section 8.1 step 8, U6: unified memory attaches at delivery to the frame copy only, for a runtime socket that
+ * declared memory_unified and never claimed a harness. The buffer, the sealed runtime_inbox and `inflight` keep the
+ * original, so a re-buffered message carries none to an HTTP or harness consumer. The owner predicate and the owner scope
+ * are re-checked in the source (`BridgeAgent.unifiedForDelivery`) on the ORIGINAL message's frozen authorization (H-4).
+ */
+import type { BridgeMessage } from "../../bridge-agent.js";
+import type { UnifiedFrameItem } from "./read-book.js";
+export declare function withConsumerUnified(out: BridgeMessage, original: BridgeMessage, session: {
+    consumer: "runtime" | "unknown";
+    harnessClaimed?: boolean;
+    unifiedConsumer: boolean;
+}, src: {
+    unifiedForDelivery(m: BridgeMessage): {
+        items: UnifiedFrameItem[];
+        pinnedMore: number;
+    } | undefined;
+}): {
+    message: BridgeMessage;
+    shown: ReadonlySet<number>;
+};

package/dist/memory/unified/escape.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Unified memory (spec \u00A710.3, R-U26, M-4, C-1): the escape the bridge applies to the text it quotes in its own lines
+ * (`Pinned:`, `Forgot:`). The runtime renders every block with its own copy of the same function (parity, plan Task 16),
+ * so this file is self-contained. Line breaks and other control characters become a space (the runtime's CONTROL_CHARS
+ * rule, memory.ts:16) so a quoted text can never open a new line; then the remaining C-1 classes are stripped; then the
+ * text is capped to `max` code points; only then are `"` and `\` backslash-escaped (ruling C21). Capping before the
+ * escape means every backslash in the output comes from a whole pair or a whole `\"`, so the output never ends in an
+ * unpaired backslash that would escape the closing quote. The escaped output can be up to twice `max` long.
+ */
+export declare const ITEM_LINE_MAX = 1000;
+export declare const LABEL_MAX = 80;
+export declare function escapeQuoted(s: string, max: number): string;
+/**
+ * Plan Task 30 (I-4 overruled): the CONTROL_TO_SPACE and C1_STRIP steps of escapeQuoted only, with no quote escaping and
+ * no cap. A migrated 7a note loses its invisible characters and is never refused for them.
+ */
+export declare function stripInvisible(s: string): string;
+/** \u00A710.3 "At ingest": every label field loses its control characters before it is stored. */
+export declare function stripLabelAtIngest(s: string): string;
+export declare function pinnedLine(pin: string): string;
+export declare function forgotLine(text: string): string;
+/** OQ-P2: true for exactly the shapes pinnedLine and forgotLine produce (single line, since the escape removes line breaks). Such a line is never saved as an agent reply. */
+export declare function isBridgeMemoryLine(text: string): boolean;

package/dist/memory/unified/index-key.d.ts

@@ -0,0 +1,8 @@
+export declare const MEMORY_INDEX_INFO = "securecoms/agent-memory-index/v1";
+export declare const QUERY_MACS_MAX = 64;
+export declare function deriveMemoryIndexKey(seed: Uint8Array): Buffer;
+/** HMAC-SHA-256 truncated to 16 bytes. */
+export declare function tokenMac(key: Uint8Array, token: string): Uint8Array;
+export declare function itemTokenMacs(key: Uint8Array, text: string): Uint8Array[];
+/** The query's tokens (stop words dropped) and their L-3 expansions, de-duplicated, capped at `max` MACs. */
+export declare function queryTokenMacs(key: Uint8Array, text: string, max?: number): Uint8Array[];

package/dist/memory/unified/item-book.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Unified memory (spec section 7.7; U9, U11, U16, L-1, R2-L-3): the ONLY caller of SqliteMlsStateStore.insertItems. Steps:
+ * the caller has captured U11 synchronously; here 4 (secret filter on the full text), 5 (chunk), 6 (seal, embed, MAC,
+ * outside the mutex), 7 (commit under the mutex: the trust decision, then one transaction), 8 (idempotent key; owner
+ * replaces reference, never the reverse). Logs are content-free (U17).
+ */
+import type { ItemCapture, ItemKind, ItemSource, ItemTrust, ScopeKind, SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import { type ServiceLog } from "../../service-log.js";
+import type { Embedder } from "../embedder/client.js";
+import type { RankingClient } from "./ranking-client.js";
+export type ItemSkip = "secret" | "empty" | "cleared" | "room_cleared" | "disabled" | "purged" | "duplicate" | "changed" | "pin_cap" | "quota" | "invalid" | "store" | "mode" | "message";
+export interface ItemWriteRequest {
+    scopeKind: ScopeKind;
+    scopeId: string;
+    channelId: string;
+    kind: ItemKind;
+    originId: string;
+    originAt: number;
+    source: ItemSource;
+    trust: ItemTrust;
+    text: string;
+    expect: ItemCapture;
+    sourceRef?: string;
+    vec?: Float32Array | null;
+    vecModelId?: string | null;
+    /** Pins and migrated notes: one item, never chunked. */
+    noChunk?: true;
+    /** Task 30: a migrated source row changed since the marker: replace the item with the same source_ref, same trust. */
+    refresh?: true;
+    /** R-U19, migration only (Task 30). */
+    capExempt?: true;
+    /** Plan audit HIGH-2: embed nothing inline; every part goes pending to ItemReembed (Task 30's migration). */
+    pendingOnly?: true;
+    /** Task 28 (pins): the caller's last W1/W2 re-check, evaluated FIRST inside the memory mutex; a veto writes nothing. */
+    precommit?: () => "mode" | "message" | null;
+}
+export interface ItemBookDeps {
+    store: Pick<SqliteMlsStateStore, "reserveItemIds" | "sealItemRecord" | "sealItemVec" | "insertItems" | "itemByOrigin" | "openItemRecord" | "evictBatch">;
+    embedder: Embedder;
+    modelId: string;
+    indexKey: Uint8Array;
+    exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+    ranking: Pick<RankingClient, "added" | "removed">;
+    /** R-U11: false on win32 while WINDOWS_SEMANTIC_ENABLED is false: no embed job runs. */
+    embedOn: () => boolean;
+    /**
+     * Plan audit HIGH-2: true while any call heartbeat of this OS user is live (the 7b E1.4 pause ItemReembed already
+     * respects). While true the write path embeds nothing inline; every part goes pending.
+     */
+    paused: () => boolean;
+    now?: () => number;
+    log?: ServiceLog;
+}
+export declare class ItemBook {
+    private readonly d;
+    private evicting;
+    constructor(d: ItemBookDeps);
+    private skip;
+    commit(r: ItemWriteRequest): Promise<{
+        ok: true;
+        itemIds: number[];
+    } | {
+        ok: false;
+        reason: ItemSkip;
+    }>;
+    /** A post-commit hot-set notification: a throw is logged (content-free) and swallowed, never turned into a write failure. */
+    private rankingNote;
+    /** H-7: batches of at most EVICT_BATCH_MAX rows, a yield between batches, one loop at a time. */
+    evictLoop(): Promise<void>;
+}

package/dist/memory/unified/item-reembed.d.ts

@@ -0,0 +1,20 @@
+/** Unified memory (spec section 7.7 step 6, 7b section 8): pending items are embedded in the background, 16 per tick, paused during calls, never on Windows (R-U11). */
+import type { SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import type { Embedder } from "../embedder/client.js";
+import { type ServiceLog } from "../../service-log.js";
+import type { RankingClient } from "./ranking-client.js";
+export declare class ItemReembed {
+    private readonly d;
+    private running;
+    constructor(d: {
+        ranking: Pick<RankingClient, "pending" | "added">;
+        store: Pick<SqliteMlsStateStore, "itemCapture" | "sealItemVec" | "updateItemVec">;
+        embedder: Embedder;
+        exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+        modelId: string;
+        paused: () => boolean;
+        embedOn: () => boolean;
+        log?: ServiceLog;
+    });
+    tick(): Promise<number>;
+}

package/dist/memory/unified/migrate.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Unified memory (spec 2026-10-10 section 14.1, section 14.5; R-U12, M-1, L-1, H-5, H-B; plan audit HIGH-1, HIGH-2, M-4):
+ * migrate, per conversation, 7a notes (pins), 7b recall (owner auto items, vectors reused) and OWNER-DM history (reference,
+ * whatever its role) into agent_memory_item, in that order (L-1). Room and person-DM history and agent_memory_fact are never
+ * migrated. Idempotent on the item key. One marker per (source, conversation): a conversation never visited, or
+ * unclassifiable, holds back nobody else's (HIGH-1). Every write is pendingOnly: the migration never embeds (HIGH-2).
+ * At most MIGRATION_BATCH source rows per read, a yield between batches (OQ-P7). Never called on a turn's path.
+ *
+ * U11 (section 14.1 "a clear or purge during migration wins"): the capture is taken once per conversation, before its first
+ * read, and every item of that conversation is checked against it in the insert transaction. The first refusal for a
+ * clear, a room clear, a disable or a purge stops the conversation. A Clear all raises every conversation's history
+ * marker to just past the clear in the store's clear transaction (fix round 1), so no later run re-imports pre-clear
+ * history (a clear keeps history, section 14.4). After a disable or a purge the markers stay, so a later run resumes.
+ */
+import { type SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import { type ServiceLog } from "../../service-log.js";
+import type { ItemBook } from "./item-book.js";
+/** Section 14.5: true while the 7a/7b tables are kept (one release). The release that drops them sets this false (the sweep stops). */
+export declare const OLD_TABLES_PRESENT = true;
+/** OQ-P7: at most this many source rows per read; a yield between reads. */
+export declare const MIGRATION_BATCH = 100;
+export type MigrationClass = {
+    kind: "owner";
+    ownerId: string;
+} | {
+    kind: "excluded";
+} | {
+    kind: "unknown";
+};
+export interface MigrationDeps {
+    store: Pick<SqliteMlsStateStore, "readNotesForMigration" | "readRecallForMigration" | "readHistoryForMigration" | "noteConversationIds" | "recallConversationIds" | "historyConversationIds" | "recallTombstoned" | "migrationMarker" | "setMigrationMarker" | "itemCapture">;
+    items: Pick<ItemBook, "commit">;
+    /**
+     * OQ-P1: "owner" with the owner identity for an owner DM; "excluded" for a conversation persisted as non-DM (M-4:
+     * never migrated, never retried, holds nothing); "unknown" when it cannot be classified now (retried on a later run).
+     */
+    classify: (conversationId: string) => MigrationClass;
+    /** Called after a conversation's notes committed pins (the bridge empties its pin cache under the memory mutex, as Task 28 does). */
+    pinsChanged?: () => Promise<void>;
+    /**
+     * Final review bridge I-3: shutdown. Checked before each conversation, each batch and each slice yield; a run that sees
+     * it stops (an abort, retried by a later run: markers cover only the batches that completed) so close() never waits
+     * on a migration ahead of the MLS drain.
+     */
+    stopping?: () => boolean;
+    log?: ServiceLog;
+}
+export interface MigrationResult {
+    notes: number;
+    recall: number;
+    history: number;
+    /** Conversations: unknown now (retried later), excluded (M-4), stopped by a U11 refusal. */
+    skipped: number;
+    excluded: number;
+    aborted: number;
+    unreadable: number;
+}
+export declare function runMigration(d: MigrationDeps, o?: {
+    only?: string;
+}): Promise<MigrationResult>;
+/** Section 14.5, before anything is served, in ONE transaction (controller ruling C22): the per-source sweep, then the clear-generation check. */
+export declare function reupgradeReconcile(store: Pick<SqliteMlsStateStore, "reupgradeReconcileUnified">): {
+    swept: {
+        notes: number;
+        recall: number;
+    };
+    cleared: number;
+};

package/dist/memory/unified/owner-scope.d.ts

@@ -0,0 +1,48 @@
+import { type AbsenceRecord } from "../recall/membership-purge.js";
+import { type ServiceLog } from "../../service-log.js";
+export interface OwnerFacts {
+    isDm: boolean | undefined;
+    pin: {
+        identityId: string;
+    } | "anomalous" | undefined;
+    member: {
+        is_agent: boolean;
+        is_agent_owner: boolean;
+    } | undefined;
+    rosterKnown: boolean;
+}
+/** A scope id when the channel is a DM whose single pinned human is the agent's owner; null when it is not; "unknown" without a fresh roster or a pin. */
+export declare function ownerScopeFrom(channelId: string, f: OwnerFacts): string | null | "unknown";
+export interface OwnerScopeSweepDeps {
+    /**
+     * The owner-DM scope ids holding items (NUL-safe, CARRY-NUL), and (final review store I-2, bridge half) the scope of each
+     * recorded DM owner, so an owner change is seen on a channel that holds no items too.
+     */
+    scopes(): string[];
+    /**
+     * Final review store I-2 (bridge half; ruling FINAL store I-2): the conversations whose 7a/7b rows a migration may still
+     * read. Each DM among them has its current owner recorded (first sight wins; a different recorded owner is left for
+     * the scope loop to settle with the same two-refresh evidence rule, and its purge raises that channel's markers).
+     */
+    oldTableChannels?(): string[];
+    recordOwner?(channelId: string, ownerIdentityId: string): void;
+    /** Roster facts only: no kill switch, provider or memory-mode input (OQ-P3). `isDm` is the persisted flag (C8). */
+    factsOf(channelId: string): OwnerFacts;
+    absenceOf(scopeId: string): AbsenceRecord | undefined;
+    markAbsent(scopeId: string, now: number): AbsenceRecord;
+    clearAbsence(scopeId: string): void;
+    purge(scopeId: string): Promise<void>;
+    now(): number;
+    /** Shutdown: the sweep stops before the next scope (like MembershipPurgeSweeper). */
+    stopping?(): boolean;
+    log?: ServiceLog;
+}
+export declare class OwnerScopeSweeper {
+    private readonly d;
+    private running;
+    constructor(d: OwnerScopeSweepDeps);
+    sweep(): Promise<{
+        purged: number;
+        frozen: number;
+    }>;
+}

package/dist/memory/unified/pin-rules.d.ts

@@ -0,0 +1,18 @@
+/** H-1: frozen; a pin token on this list needs no owner occurrence. Contents approved under OQ-P6. */
+export declare const FRAMING_WORDS: ReadonlySet<string>;
+/**
+ * C-1 with R2-L-1: NFC first; then keep letters (L), numbers (N), punctuation (P), space separators (Zs), the 14 symbols
+ * `$ % & + = < > ~ ^ | # @ * /`, and combining marks Mn and Mc except the variation selectors (including U+180B-180F). Everything else (Cf, Co,
+ * Cn, Cc, tag characters, bidi controls, zero-width characters, other symbols) is stripped.
+ */
+export declare function allowlistPin(raw: string): string;
+/**
+ * H-1: every pin token not on FRAMING_WORDS must occur, as an exact token, in the owner's current message or in an
+ * owner-trust TYPED item delivered with this turn (the caller passes only COVERAGE_SOURCES texts). No stems, no allowance.
+ */
+export declare function pinCoverage(pinStripped: string, ownerMessage: string, coverTexts: readonly string[]): {
+    ok: true;
+} | {
+    ok: false;
+    uncovered: number;
+};

package/dist/memory/unified/ranking-client.d.ts

@@ -0,0 +1,48 @@
+import { type ServiceLog } from "../../service-log.js";
+import type { FromWorker, OpenedItem, RankQuery, ToWorker, WorkerInit } from "./worker-protocol.js";
+export interface RankingTransport {
+    post(m: ToWorker): void;
+    onMessage(cb: (m: FromWorker) => void): void;
+    onExit(cb: () => void): void;
+    terminate(): Promise<void>;
+}
+export declare function workerTransport(init: WorkerInit, distDir: string): RankingTransport;
+export declare class RankingClient {
+    private readonly d;
+    private t;
+    /** Final review bridge I-2(b): set by close(); no call after it spawns a worker or posts. */
+    private closed;
+    private seq;
+    private readonly waiting;
+    private misses;
+    private hot;
+    constructor(d: {
+        spawn: () => RankingTransport;
+        log?: ServiceLog;
+    });
+    private transport;
+    private ask;
+    query(q: RankQuery, deadlineAt: number): Promise<{
+        items: OpenedItem[];
+        openFailed: number;
+    } | "late" | "failed">;
+    pins(scopeId: string, maxChars: number, deadlineAt: number): Promise<{
+        pins: OpenedItem[];
+        more: number;
+    } | "late" | "failed">;
+    pending(limit: number, deadlineAt: number): Promise<Extract<FromWorker, {
+        type: "pending";
+    }>["rows"] | "late" | "failed">;
+    /**
+     * Final review bridge I-2: hot-set notifications reach a RUNNING worker only. With none running they are no-ops (a worker
+     * spawned later warms from the database, so nothing is lost): a purge, clear or write while memory is off never starts
+     * a resident worker, nothing respawns after close(), and a post that throws never escapes into a committed write's path.
+     */
+    private notify;
+    added(itemIds: number[]): void;
+    removed(itemIds: number[]): void;
+    reset(): void;
+    hotBytes(): number;
+    deadlineMisses(): number;
+    close(): Promise<void>;
+}

package/dist/memory/unified/ranking-core-constants.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Unified memory (spec section 8.1, section 8.5; plan Task 27): the read limits, split out of ranking-core.ts so the
+ * main-thread read path (read-book.ts) never imports the module that holds the SQL (T-33). No imports.
+ */
+export declare const TYPED_ITEMS_MAX = 10;
+export declare const VOICE_ITEMS_MAX = 3;
+export declare const READ_CHARS_MAX = 6000;
+export declare const PINNED_CHARS_MAX = 4000;

package/dist/memory/unified/ranking-core.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Unified memory (spec section 8.1 steps 3 to 6, section 8.3, section 8.5; R-U16 rev2, R-U18, H-7): ranking over a READ-ONLY connection.
+ * Runs inside the ranking worker in production (Task 14) and in-process only in tests and the eval (Task 35).
+ * Every embedded item is hot (int8, one float scale per vector); there is no cold vector path. Keyword MACs boost items
+ * already in the meaning list and are the only candidate source for an item still pending its embed and for the
+ * keyword-only read (no query vector, or warm off: Windows, R-U11). U1-G (architect recall-gate memo, section 4).
+ */
+import type { DatabaseSync } from "node:sqlite";
+import type { FromWorker, ToWorker, WorkerInit } from "./worker-protocol.js";
+export declare const DIMS = 384;
+export declare const OWNER_SCOPE_PRIOR = 0.05;
+export declare const RECENCY_FLOOR = 0.85;
+/** U1-G (C): 0.15 -> 0.05, a holding value until a replaced-fact eval exists (Part 2). The 0.85 floor is unchanged. */
+export declare const RECENCY_SLOPE = 0.05;
+export declare const RRF_K = 60;
+export declare const HOT_TOKEN_MAX_POSTINGS = 5000;
+export declare const LIST_MAX = 50;
+/** U1-G (A): section 8.3's freshness is a tie-break: it orders only fused scores within this of each other (float
+ *  rounding; distinct RRF sums at k = 60 over ranks below 50 differ by far more). */
+export declare const FRESHNESS_TIE_EPSILON = 1e-12;
+/** U1-G (D): hot set slots reserved above the warm count, and the growth factor (was doubling). */
+export declare const HOT_SET_HEADROOM = 1024;
+export declare const HOT_SET_GROWTH = 1.25;
+export { TYPED_ITEMS_MAX, VOICE_ITEMS_MAX, READ_CHARS_MAX, PINNED_CHARS_MAX } from "./ranking-core-constants.js";
+/** section 8.5: max(0.85, 1 - age_days/365 x slope), slope 0.05 (U1-G). `slope` is the plan Task 35 eval override only. */
+export declare function recencyWeight(ageDays: number, slope?: number): number;
+/** U1-G (D): the warm reserve, min(count, N) plus the headroom (never N for every agent). */
+export declare function hotSetReserve(embeddedCount: number): number;
+/** U1-G (D): the capacity a grow to hold `need` slots picks: x1.25, capped at N, at least `need`. Past N (the store's
+ *  eviction lags an insert batch) it steps by the headroom, so a long tail over N never grows one slot at a time. */
+export declare function hotSetGrowth(cap: number, need: number): number;
+/** Packed int8 vectors with a per-vector scale; swap-remove keeps it dense. */
+export declare class HotSet {
+    private cap;
+    private n;
+    private q;
+    private scale;
+    private ids;
+    private at;
+    private scopeOf;
+    private pin;
+    private readonly slotOf;
+    private readonly scopes;
+    private readonly scopeIdx;
+    get size(): number;
+    get capacity(): number;
+    vectorBytes(): number;
+    bytes(): number;
+    /** U1-G (D): sets the capacity to at least `slots` in one allocation (the warm reserve). */
+    reserve(slots: number): void;
+    private grow;
+    /** The old buffers are dropped (unreferenced) as soon as they are copied. */
+    private resize;
+    add(e: {
+        itemId: number;
+        vec: Float32Array;
+        scopeId: string;
+        originAt: number;
+        pinned: boolean;
+    }): void;
+    remove(itemId: number): void;
+    clear(): void;
+    /** section 8.5: sim (int8 dot x scale), meaning threshold, then (sim + prior) x recency; the top `k` by that score. */
+    topK(query: Float32Array, allowed: ReadonlySet<string>, o: {
+        k: number;
+        nowMs: number;
+        ownerScope: string | null;
+        threshold: number;
+        prior?: number;
+        recencySlope?: number;
+    }): Array<{
+        itemId: number;
+        sim: number;
+        score: number;
+    }>;
+}
+export declare class RankingCore {
+    private readonly init;
+    private readonly db;
+    private readonly hot;
+    private readonly stmts;
+    constructor(init: WorkerInit, db: DatabaseSync);
+    /** Prepared once per distinct statement text (the keyword statement varies only with the MAC and scope counts). */
+    private stmt;
+    hotCount(): number;
+    hotCapacity(): number;
+    /** The meaning list a query would fuse (section 8.5 scores, the init's eval overrides applied when set). */
+    meaningScores(vec: Float32Array, scopes: readonly string[], ownerScope: string | null, nowMs: number): Array<{
+        itemId: number;
+        sim: number;
+        score: number;
+    }>;
+    hotBytes(): number;
+    private open;
+    private fields;
+    private row;
+    private addRow;
+    /** section 8.5 warm: one row per read, a yield between rows; returns the hot count. A disabled warm (win32 keyword-only) loads nothing. */
+    warm(): Promise<number>;
+    /** Opens a record; null on any failure or a source_ref mismatch (section 11.3). */
+    private openRecord;
+    private opened;
+    /** H-7: one batched statement, LIMIT 5,001 per MAC inside the allowed scopes; a MAC that fills its limit is skipped. */
+    private keyword;
+    /** section 8.1 step 5: message ids of the newest 50 history turns of the conversation, plus the current message. */
+    private excluded;
+    private rank;
+    private pins;
+    private pending;
+    /**
+     * Final review bridge M-4: `handle` with a per-message catch. A request that throws (a prepare failure, a decode throw)
+     * is answered `failed` instead of becoming an unhandled rejection that kills the worker; a notification that throws is
+     * dropped (a later request still warms from the database). Content-free: the error is never sent or logged.
+     */
+    handleSafe(m: ToWorker): Promise<FromWorker | null>;
+    handle(m: ToWorker): Promise<FromWorker | null>;
+}

package/dist/memory/unified/ranking-inprocess.d.ts

@@ -0,0 +1,3 @@
+import type { RankingTransport } from "./ranking-client.js";
+import type { WorkerInit } from "./worker-protocol.js";
+export declare function inProcessTransport(init: WorkerInit): RankingTransport;

package/dist/memory/unified/ranking-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/memory/unified/read-book.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Unified memory (spec section 8.1; H-4, U11, U15): the per-turn read. The capture is taken first (U11); pinned facts come
+ * from a cache keyed by the owner-DM scope id (never per agent, H-A) and filled from the worker under the memory mutex;
+ * the search runs on the worker; everything shares the turn kind's one deadline (600 ms typed, 250 ms voice). Past it:
+ * pinned facts only (from a current cache). Nothing attaches late. Delivery re-checks the capture and the owner scope.
+ * No SQL here (T-33): the constants come from the import-free ranking-core-constants.ts, never ranking-core.ts.
+ */
+import { type SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import type { Embedder } from "../embedder/client.js";
+import type { RankingClient } from "./ranking-client.js";
+export interface UnifiedFrameItem {
+    block: "pinned" | "owner" | "reference";
+    id: number;
+    source: string;
+    at: number;
+    text: string;
+}
+/** The runtime's parseUnified limits (connect-agent-runtime memory-unified.ts): one item over them blanks the whole block there. */
+export declare const FRAME_ITEMS_MAX = 210;
+export declare const FRAME_TEXT_MAX = 1000;
+export declare class UnifiedReadBook {
+    private readonly d;
+    private readonly entries;
+    private readonly pinCache;
+    /**
+     * Plan audit M-6: the texts DELIVERED with each message, kept until ack/nack/retire (`drop`), so a forget that follows
+     * a pin in the same message (the pin's dropChannelLocked empties `entries`) still finds its text for the Forgot: line.
+     * Cleared by a clear (dropAllLocked) and an owner-scope purge (dropScopeLocked), never by a channel cache refresh.
+     */
+    private readonly shown;
+    private reads;
+    /** Fix round 1: turns whose read missed its deadline (a local late, or a pins/query answer late or failed); one per turn. */
+    private misses;
+    /**
+     * Fix round 1 (ruling): bumped by every drop*Locked and by bumpGeneration (Task 28: a pin insert). Taken before the
+     * pins request and compared at install and before the entry is kept, so a drop during an await is never undone.
+     */
+    private gen;
+    /** Fix round 2: reads thrown away because the generation moved (a drop, a pin insert); not deadline misses. */
+    private discarded;
+    constructor(d: {
+        store: Pick<SqliteMlsStateStore, "itemCapture">;
+        ranking: Pick<RankingClient, "query" | "pins">;
+        embedder: Embedder;
+        embedOn: () => boolean;
+        indexKey: Uint8Array;
+        exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+        now?: () => number;
+    });
+    /** The health key memory_reads: owner-DM reads started since boot. */
+    readsAttempted(): number;
+    /** The health key memory_deadline_misses: owner-DM turns that got no search result in time (U15). */
+    deadlineMisses(): number;
+    /** The health key memory_reads_discarded: reads not kept because a drop or pin insert moved the generation during them. */
+    readsDiscarded(): number;
+    /** Invalidates the pin cache and every read in flight (Task 28 calls it, under the memory mutex, when a pin is inserted). */
+    bumpGeneration(): void;
+    prepare(p: {
+        messageId: string;
+        channelId: string;
+        scopeId: string;
+        text: string;
+        kind: "text" | "voice";
+    }): Promise<void>;
+    /** ws flush (synchronous): the entry's own channel and owner scope, its capture still current (H-4, U11). */
+    deliverable(messageId: string, channelId: string, scopeIdNow: string): {
+        items: UnifiedFrameItem[];
+        pinnedMore: number;
+    } | undefined;
+    /** Section 7.4 step 3: texts of owner-trust TYPED items shown with this delivery (never owner_voice, never reference). */
+    coverageTexts(messageId: string, shown: ReadonlySet<number>): string[];
+    /** M-6: what was DELIVERED with this message (kept until ack), not the prepare-time entry a cache refresh can drop. */
+    shownText(messageId: string, itemId: number): string | undefined;
+    /** Task 29 fix round 1: a forgotten item's delivered text leaves the shown map at once (not only at ack). */
+    forgetShown(messageId: string, itemId: number): void;
+    drop(messageId: string): void;
+    dropAllLocked(): void;
+    dropChannelLocked(channelId: string): void;
+    dropScopeLocked(scopeId: string): void;
+}

package/dist/memory/unified/switch.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Unified agent memory, part 1 (spec 2026-10-10 §18, R-U25): a compiled literal, default off, flipped only by the
+ * release task after the Mac mini live check. A backend flag is not used: it would let the server widen cross-scope
+ * reads. While false the bridge behaves as 0.28.2 on every memory path.
+ */
+export declare const UNIFIED_MEMORY_PART1 = true;
+/** `injected` is the test seam (the bridge agent's deps field for this switch); production never passes it (switch.arch.test.ts). */
+export declare function unifiedPart1On(injected?: boolean): boolean;

package/dist/memory/unified/text.d.ts

@@ -0,0 +1,15 @@
+export declare function foldText(s: string): string;
+export declare function tokens(s: string): string[];
+/** H-1, H-2: English cardinals and ordinals count as digit-bearing (65 words, frozen). */
+export declare const NUMBER_WORDS: ReadonlySet<string>;
+/** A canonical Roman numeral (lower case after foldText). Note: "i", "v", "x" and "mix" match; Task 35 measures the effect. */
+export declare function isRomanNumeral(t: string): boolean;
+export declare function isDigitBearing(t: string): boolean;
+/** §11.5: a fixed English stop-word list (126 words: the NLTK English list without its contractions), never indexed. */
+export declare const STOP_WORDS: ReadonlySet<string>;
+/** L-3: the fixed English suffix set for query-side expansion (the plan enumerates it, spec §11.5). y↔ies is added below. */
+export declare const QUERY_SUFFIXES: readonly string[];
+/** §11.5: an item's exact, de-duplicated tokens, stop words dropped. No stems. */
+export declare function indexTokens(text: string): string[];
+/** L-3: the token, the token plus each suffix, the token minus each suffix it ends with (never below 3 characters), and y↔ies. */
+export declare function queryExpansions(t: string): string[];