@staix/agent-mem 0.4.0 → 0.6.0

package/src/mcp-memory.ts

@@ -10,14 +10,17 @@ import { canonicalPath, realPath } from "./memory/platform.ts";
 import { createStandalonePolicy, type StandalonePolicyOptions } from "./memory/policy.ts";
 import { memoryProjectKey } from "./memory/project.ts";
 import { registerReaderLease } from "./memory/reader-lease.ts";
-import { SearchIndex } from "./memory/search-fts.ts";
-import { readShardedSelection, resolveAlias } from "./memory/shard.ts";
+import { type ReadRef, type ReadWindow, SearchIndex } from "./memory/search-fts.ts";
+import { aliasedKeys, readShardedSelection, resolveAlias } from "./memory/shard.ts";
 import { MemoryStore, openShardStore, type Graph, type View } from "./memory/store.ts";
 import { vaultCandidates } from "./memory/vault.ts";
 import { WorkListStore, type WorkListFields } from "./memory/work-lists.ts";
 
-// ponytail: 5000 rows per tier per operation; above this ceiling refuse rather than select on an incomplete privacy-filtered corpus. Upgrade to screened streaming pagination.
+// Graph retains its complete-corpus ceiling; search/timeline/show page matching bodies instead.
 export const MCP_SCAN_LIMIT = 5000;
+// ponytail: rank the newest 5000 permitted matching candidates per tier; use since to narrow or upgrade to a policy-bound persistent index for global ranking.
+const SEARCH_CANDIDATES = 5000;
+const READ_PAGE = 256;
 export interface MemoryMcpOptions { cwd: string; base?: string; project?: string; policy?: StandalonePolicyOptions }
 export interface MemoryMcp { tools: McpHandlers; close(): void }
 const unavailable = (): never => { throw new Error("memory operation unavailable"); };
@@ -27,7 +30,7 @@ const textOf = (args: Record<string, unknown>, key: string, optional = false): s
   const value = args[key]; if (value === undefined && optional) return undefined;
   return typeof value === "string" && value.trim() && !value.includes("\0") ? value : unavailable();
 };
-const sinceOf = (args: Record<string, unknown>): string | undefined => { const since = textOf(args, "since", true); if (since !== undefined && !Number.isFinite(Date.parse(since))) unavailable(); return since; };
+const sinceOf = (args: Record<string, unknown>): string | undefined => { const since = textOf(args, "since", true); if (since !== undefined && !Number.isFinite(Date.parse(since))) unavailable(); return since === undefined ? undefined : new Date(since).toISOString(); };
 
 /** All identities are resolved once. Per-call arguments cannot change projects, homes, profiles or policy. */
 export function createMemoryMcp(options: MemoryMcpOptions): MemoryMcp {
@@ -40,15 +43,17 @@ export function createMemoryMcp(options: MemoryMcpOptions): MemoryMcp {
     const selection = readSelector(base).revision;
     const sharded = !!lstatSync(join(base, "shards.json"), { throwIfNoEntry: false });
     const shardSelection = sharded ? JSON.stringify(readShardedSelection(base)) : undefined;
-    const store = sharded ? openShardStore({ memoryDir: base, project, deferPromotions: true }) : new MemoryStore({ memoryDir: base, deferPromotions: true });
+    // #27: the project filter covers the canonical key and every key aliased to it; the keys are fixed with the project, so a later alias change fails the guard below.
+    const aliases = aliasedKeys(base, project), reconcile = aliases.length ? { canonical: project, aliases } : undefined;
+    const store = sharded ? openShardStore({ memoryDir: base, project, deferPromotions: true, ...(reconcile ? { reconcile } : {}) }) : new MemoryStore({ memoryDir: base, deferPromotions: true, ...(reconcile ? { reconcile } : {}) });
     closers.push(() => store.close());
     const capture = new CaptureStore({ memoryDir: base, project }); closers.push(() => capture.close());
-    const candidates = new CandidateStore({ memoryDir: base }); closers.push(() => candidates.close());
-    const work = new WorkListStore({ base, project, policy: async row => { const permitted = await policy.screen(row); guard(); return permitted; } }); closers.push(() => work.close());
+    const candidates = new CandidateStore({ memoryDir: base, ...(reconcile ? { reconcile } : {}) }); closers.push(() => candidates.close());
+    const work = new WorkListStore({ base, project, aliases, policy: async row => { const permitted = await policy.screen(row); guard(); return permitted; } }); closers.push(() => work.close());
     const guard = () => {
       if (closed) unavailable();
       release.verify();
-      if (resolveAlias(base, requested) !== project || readSelector(base).revision !== selection) unavailable();
+      if (resolveAlias(base, requested) !== project || aliasedKeys(base, project).join("\n") !== aliases.join("\n") || readSelector(base).revision !== selection) unavailable();
       const split = !!lstatSync(join(base, "shards.json"), { throwIfNoEntry: false });
       if (split !== sharded || split && JSON.stringify(readShardedSelection(base)) !== shardSelection) unavailable();
     };
@@ -63,46 +68,84 @@ export function createMemoryMcp(options: MemoryMcpOptions): MemoryMcp {
       if (rows.length > MCP_SCAN_LIMIT) unavailable();
       return screen(rows.filter(row => row.project === project));
     };
-    const captures = async () => screen(capture.rows({ project, limit: MCP_SCAN_LIMIT + 1 }));
-    const find = (rows: View[], id: string): View | null => { const found = rows.filter(row => row.id === id || row.id.startsWith(id.replace(/^mem:/, ""))); return found.length === 1 ? found[0]! : null; };
+    const readPermitted = async <T>(read: (window: ReadWindow) => { rows: T[]; next?: ReadRef; engine?: "fts5" | "substring" },
+      options: Omit<ReadWindow, "project" | "limit" | "after">, cap: number, matches: (row: T, engine?: "fts5" | "substring") => boolean = () => true): Promise<T[]> => {
+      const result: T[] = []; let after: ReadWindow["after"];
+      while (result.length < cap) {
+        guard();
+        const page = read({ ...options, project, limit: READ_PAGE, after });
+        for (const row of page.rows) if (await policy.screen(row) && matches(row, page.engine)) {
+          result.push(row); if (result.length === cap) break;
+        }
+        guard();
+        if (!page.next) break;
+        after = { position: page.next.position, id: page.next.id };
+      }
+      return result;
+    };
+    const anchorAt = async (id: string): Promise<string | undefined> => {
+      if (/^capture:[1-9][0-9]*$/.test(id)) {
+        return (await readPermitted(window => capture.readPage(window), { id: id.slice(8) }, 1))[0]?.at;
+      }
+      const rows = await readPermitted(window => store.readPage({ ...window, includeSuperseded: true }), { prefix: id.replace(/^mem:/, "") }, 2);
+      return rows.length === 1 ? rows[0]!.at : undefined;
+    };
     const tools: McpHandlers = {
       async amem_search(args) {
         bound(args, ["query", "limit", "since", "includeCapture"]); const query = textOf(args, "query")!, limit = limitOf(args), since = sinceOf(args);
         if (args.includeCapture !== undefined && typeof args.includeCapture !== "boolean") unavailable();
         if (!await policy.screen({ query })) unavailable();
-        const notes = await curated(), recalls = args.includeCapture === false ? [] : await captures();
-        const hits = [...notes.map(view => ({ source: "curated" as const, evidence: true, view, ref: view.id, at: view.at, tier: view.tier, body: `${view.title ?? ""}\n${view.text}\n${view.about.join(" ")}` })),
-          ...recalls.map(row => ({ source: "capture" as const, evidence: false, capture: row, ref: `capture:${row.id}`, at: row.at, tier: "capture", body: `${row.excerpt}\n${row.paths.join(" ")}\n${row.event}` }))].filter(hit => !since || Date.parse(hit.at) >= Date.parse(since));
         const index = new SearchIndex(":memory:");
         try {
-          index.resync(() => hits.map(hit => ({ id: hit.ref, at: hit.at, project, tier: hit.tier, scope: "project", body: hit.body })));
-          if (index.available && index.needsResync(hits.length)) unavailable();
-          const ranks = new Map(index.query(query, MCP_SCAN_LIMIT * 2, project).map(row => [row.ref, row.rank]));
           const words = query.toLowerCase().split(/\s+/).filter(Boolean);
+          const captureState: { engine?: "fts5" | "substring" } = {};
+          const recalls = args.includeCapture === false ? [] : await readPermitted(window => {
+            const page = capture.readPage({ ...window, query, ...(captureState.engine === "substring" ? { match: "substring" as const } : {}) });
+            captureState.engine ??= page.engine;
+            return page;
+          }, { since }, SEARCH_CANDIDATES,
+            (row, engine) => index.available && engine === "fts5" || words.every(word => `${row.excerpt}\n${row.paths.join(" ")}\n${row.event}`.toLowerCase().includes(word)));
+          const useFts = index.available && captureState.engine !== "substring";
+          const notes = await readPermitted(window => store.readPage({ ...window, ...(useFts ? { query } : {}) }), { since }, SEARCH_CANDIDATES,
+            view => useFts || words.every(word => `${view.title ?? ""}\n${view.text}\n${view.about.join(" ")}`.toLowerCase().includes(word)));
+          const hits = [...notes.map(view => ({ source: "curated" as const, evidence: true, view, ref: view.id, at: view.at, tier: view.tier, body: `${view.title ?? ""}\n${view.text}\n${view.about.join(" ")}` })),
+            ...recalls.map(row => ({ source: "capture" as const, evidence: false, capture: row, ref: `capture:${row.id}`, at: row.at, tier: "capture", body: `${row.excerpt}\n${row.paths.join(" ")}\n${row.event}` }))].filter(hit => !since || Date.parse(hit.at) >= Date.parse(since));
+          if (useFts) {
+            index.resync(() => hits.map(hit => ({ id: hit.ref, at: hit.at, project, tier: hit.tier, scope: "project", body: hit.body })));
+            if (index.needsResync(hits.length)) unavailable();
+          }
+          const ranks = new Map((useFts ? index.query(query, MCP_SCAN_LIMIT * 2, project) : []).map(row => [row.ref, row.rank]));
           const selected = hits.flatMap(hit => {
             const rank = ranks.get(hit.ref);
-            if (index.available ? rank === undefined : !words.every(word => hit.body.toLowerCase().includes(word))) return [];
+            if (useFts ? rank === undefined : !words.every(word => hit.body.toLowerCase().includes(word))) return [];
             const weight = hit.tier === "long" ? 1 : hit.tier === "capture" ? 0.5 : 0.9;
             const score = -(rank ?? -1) * weight / (1 + Math.max(0, Date.now() - Date.parse(hit.at)) / (30 * 86400_000));
             return [{ source: hit.source, evidence: hit.evidence, ...(hit.source === "curated" ? { view: hit.view } : { capture: hit.capture }), score }];
           }).sort((a, b) => b.score - a.score).slice(0, limit);
-          guard(); return { engine: index.available ? "fts5" : "substring", hits: selected };
+          guard(); return { engine: useFts ? "fts5" : "substring", hits: selected };
         } finally { index.close(); }
       },
       async amem_show(args) {
         bound(args, ["id"]); guard(); const id = textOf(args, "id")!;
-        if (/^capture:[1-9][0-9]*$/.test(id)) { const row = (await captures()).find(row => `capture:${row.id}` === id); guard(); return row ? { source: "capture", evidence: false, capture: row } : null; }
-        const result = find(await curated(true), id); guard(); return result;
+        if (/^capture:[1-9][0-9]*$/.test(id)) {
+          const row = (await readPermitted(window => capture.readPage(window), { id: id.slice(8) }, 1))[0];
+          guard(); return row ? { source: "capture", evidence: false, capture: row } : null;
+        }
+        const rows = await readPermitted(window => store.readPage({ ...window, includeSuperseded: true }), { prefix: id.replace(/^mem:/, "") }, 2);
+        guard(); return rows.length === 1 ? rows[0]! : null;
       },
       async amem_timeline(args) {
-        bound(args, ["id", "since", "limit"]); const rows = await curated(true), recalls = await captures(), id = textOf(args, "id", true), since = sinceOf(args), limit = limitOf(args);
-        const entries = [...rows.map(row => ({ at: row.at, value: row as unknown })), ...recalls.map(row => ({ at: row.at, value: { source: "capture", evidence: false, capture: row } as unknown }))];
-        let selected = entries.filter(row => !since || Date.parse(row.at) >= Date.parse(since));
-        if (id) {
-          const anchor = id.startsWith("capture:") ? recalls.find(row => `capture:${row.id}` === id) : find(rows, id);
-          if (!anchor) return []; selected = selected.sort((a, b) => Math.abs(Date.parse(a.at) - Date.parse(anchor.at)) - Math.abs(Date.parse(b.at) - Date.parse(anchor.at)));
-        } else selected.sort((a, b) => b.at.localeCompare(a.at));
-        guard(); return selected.slice(0, limit).map(row => row.value);
+        bound(args, ["id", "since", "limit"]);
+        const id = textOf(args, "id", true), since = sinceOf(args), limit = limitOf(args);
+        guard();
+        const anchor = id ? await anchorAt(id) : undefined;
+        if (id && !anchor) { guard(); return []; }
+        const rows = await readPermitted(window => store.readPage({ ...window, includeSuperseded: true }), { since, anchor }, limit);
+        const recalls = await readPermitted(window => capture.readPage(window), { since, anchor }, limit);
+        const entries = [...rows.map(row => ({ at: row.at, ref: row.id, value: row as unknown })),
+          ...recalls.map(row => ({ at: row.at, ref: `capture:${row.id}`, value: { source: "capture", evidence: false, capture: row } as unknown }))];
+        entries.sort((a, b) => (anchor ? Math.abs(Date.parse(a.at) - Date.parse(anchor)) - Math.abs(Date.parse(b.at) - Date.parse(anchor)) : Date.parse(b.at) - Date.parse(a.at)) || (a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0));
+        guard(); return entries.slice(0, limit).map(row => row.value);
       },
       async amem_graph(args) {
         bound(args, ["start", "hops", "limit"]); const start = textOf(args, "start")!, cap = limitOf(args), hops = args.hops ?? 1;

package/src/memory/aliases.ts

@@ -0,0 +1,83 @@
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export const SHARD_SCHEMA = "agent-hub.memory.shard/v1";
+
+export interface AliasOp { schema: typeof SHARD_SCHEMA; op: "alias"; at: string; machine: string; alias: string; key: string; actor: string }
+/**
+ * #27 option 2: the person's removal of one alias. An append-only op in the same local `aliases.jsonl` (never a shared-v1 segment, so no shared-v1 reader sees a new op
+ * kind there: an older reader skips the line and keeps resolving the alias, which is the C1 "local only" placement). The latest op for an alias wins, so after an
+ * `unalias` the key resolves to itself again, and a later `alias` op maps it again.
+ */
+export interface UnaliasOp { schema: typeof SHARD_SCHEMA; op: "unalias"; at: string; machine: string; alias: string; actor: string }
+export type AliasLogOp = AliasOp | UnaliasOp;
+
+export function aliasLogPath(base: string): string {
+  return join(base, "aliases.jsonl");
+}
+
+/**
+ * One person-reviewed alias op, appended to `aliases.jsonl`. An alias never chains (its target must not itself be
+ * an alias), and a machine that races the append keeps both ops: the latest one wins at read time.
+ */
+export function appendAlias(base: string, input: { alias: string; key: string; actor: string; machine: string; at?: string }): AliasOp {
+  const alias = input.alias.trim(), key = input.key.trim();
+  if (!alias || !key) throw new Error("an alias needs both keys");
+  if (alias === key) throw new Error("an alias cannot target itself");
+  if (resolveAlias(base, key) !== key) throw new Error("an alias cannot target another alias");
+  // The other direction too, using only the latest op per alias: a target abandoned by a later retarget or a removal is free again.
+  const currentTargets = new Set(effectiveAliases(base).values());
+  if (currentTargets.has(alias)) throw new Error("an alias target cannot become an alias");
+  const op: AliasOp = { schema: SHARD_SCHEMA, op: "alias", at: input.at ?? new Date().toISOString(), machine: input.machine, alias, key, actor: input.actor };
+  mkdirSync(base, { recursive: true, mode: 0o700 });
+  appendFileSync(aliasLogPath(base), JSON.stringify(op) + "\n", { mode: 0o600 });
+  return op;
+}
+
+/** Every alias and unalias op in order (the full history); a malformed or unknown line is skipped, never fatal. */
+export function listAliases(base: string): AliasLogOp[] {
+  let text = "";
+  try { text = readFileSync(aliasLogPath(base), "utf8"); } catch { return []; }
+  const ops: AliasLogOp[] = [];
+  for (const line of text.split("\n").filter(Boolean)) {
+    try {
+      const op = JSON.parse(line) as AliasLogOp;
+      if (op?.schema !== SHARD_SCHEMA || typeof op.alias !== "string") continue;
+      if (op.op === "alias" && typeof op.key === "string") ops.push(op);
+      else if (op.op === "unalias") ops.push(op);
+    } catch { /* a malformed line is skipped */ }
+  }
+  return ops;
+}
+
+/** The aliases in force: for each alias key the latest op decides, and an `unalias` removes it. Map of alias key to canonical key. */
+export function effectiveAliases(base: string): Map<string, string> {
+  const latest = new Map<string, string>();
+  for (const op of listAliases(base)) { if (op.op === "alias") latest.set(op.alias, op.key); else latest.delete(op.alias); }
+  return latest;
+}
+
+/** The canonical key for a possibly aliased one: the latest op for it, one hop (aliases never chain). An unaliased key is its own canonical key. */
+export function resolveAlias(base: string, key: string): string {
+  return effectiveAliases(base).get(key) ?? key;
+}
+
+/** Every key currently aliased to `canonical`, sorted (the keys whose curated rows the CLI and MCP project filter now covers, #27 option 1). */
+export function aliasedKeys(base: string, canonical: string): string[] {
+  return [...effectiveAliases(base)].filter(([, key]) => key === canonical).map(([alias]) => alias).sort();
+}
+
+/**
+ * One person-reviewed removal, appended to `aliases.jsonl`. Nothing is rewritten: the alias line stays in the history and the later op wins. Refused when the key is
+ * not aliased now, so a typo never records a removal that means nothing.
+ */
+export function appendUnalias(base: string, input: { alias: string; actor: string; machine: string; at?: string }): UnaliasOp {
+  const alias = input.alias.trim();
+  if (!alias) throw new Error("an alias removal needs the alias key");
+  if (!effectiveAliases(base).has(alias)) throw new Error(`no alias to remove: ${alias} is not aliased now`);
+  const op: UnaliasOp = { schema: SHARD_SCHEMA, op: "unalias", at: input.at ?? new Date().toISOString(), machine: input.machine, alias, actor: input.actor };
+  mkdirSync(base, { recursive: true, mode: 0o700 });
+  appendFileSync(aliasLogPath(base), JSON.stringify(op) + "\n", { mode: 0o600 });
+  return op;
+}
+

package/src/memory/candidates.ts

@@ -76,7 +76,11 @@ export class CandidateStore {
   readonly path: string;
   private readonly db: Database;
   private readonly now: () => number;
-  constructor(options: { home?: string; memoryDir?: string; now?: () => number } = {}) {
+  /** #27: the keys aliased to the canonical project; its candidates read, accept and reject under the canonical key. Absent in the library default. */
+  private readonly reconcile?: { canonical: string; aliases: readonly string[] };
+  private scope(project: string): string { return JSON.stringify(this.reconcile && project === this.reconcile.canonical ? [project, ...this.reconcile.aliases] : [project]); }
+  constructor(options: { home?: string; memoryDir?: string; now?: () => number; reconcile?: { canonical: string; aliases: readonly string[] } } = {}) {
+    if (options.reconcile?.aliases.length) this.reconcile = { canonical: options.reconcile.canonical, aliases: [...options.reconcile.aliases] };
     if (options.memoryDir !== undefined && options.home !== undefined) throw new Error("choose a home or an exact memory directory");
     this.dir = options.memoryDir ?? (options.home === undefined ? memoryHome() : join(options.home, "memory"));
     this.now = options.now ?? Date.now;
@@ -112,7 +116,7 @@ export class CandidateStore {
   get(id: string, project: string): Candidate | undefined {
     if (!candidateId(id) || !text(project, 400)) throw new Error("invalid candidate identity");
     this.prune();
-    const row = this.db.query("SELECT * FROM candidates WHERE id = ? AND project = ?").get(id, project) as Parameters<CandidateStore["decode"]>[0] | null;
+    const row = this.db.query("SELECT * FROM candidates WHERE id = ? AND project IN (SELECT value FROM json_each(?))").get(id, this.scope(project)) as Parameters<CandidateStore["decode"]>[0] | null;
     return row ? this.decode(row) : undefined;
   }
   list(filter: CandidateFilter): Candidate[] {
@@ -120,7 +124,7 @@ export class CandidateStore {
     const limit = filter.limit ?? CANDIDATE_RETENTION.count;
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > CANDIDATE_RETENTION.count) throw new Error("candidate limit must be 1..500");
     this.prune();
-    const where = ["project = ?"], bind: (string | number)[] = [filter.project];
+    const where = ["project IN (SELECT value FROM json_each(?))"], bind: (string | number)[] = [this.scope(filter.project)];
     if (filter.status === undefined) where.push("status IN ('pending', 'accepting')"); else if (filter.status !== "all") { where.push("status = ?"); bind.push(filter.status); }
     if (filter.kind) { where.push("kind = ?"); bind.push(filter.kind); }
     return (this.db.query(`SELECT * FROM candidates WHERE ${where.join(" AND ")} ORDER BY at DESC, rowid DESC LIMIT ?`).all(...bind, limit) as Parameters<CandidateStore["decode"]>[0][]).map(row => this.decode(row));
@@ -137,7 +141,7 @@ export class CandidateStore {
   counters(project: string, entry?: string): Counter[] {
     if (!text(project, 400) || entry !== undefined && !entryId(entry)) throw new Error("invalid counter filter");
     this.prune();
-    const rows = this.db.query("SELECT * FROM counters WHERE project = ? ORDER BY at DESC, rowid DESC").all(project) as { id: string; payload: string; at: number; rendered: number | null; delivered: number | null; cited: number | null }[];
+    const rows = this.db.query("SELECT * FROM counters WHERE project IN (SELECT value FROM json_each(?)) ORDER BY at DESC, rowid DESC").all(this.scope(project)) as { id: string; payload: string; at: number; rendered: number | null; delivered: number | null; cited: number | null }[];
     return rows.map(row => ({ id: row.id, key: JSON.parse(row.payload) as CounterKey, createdAt: new Date(row.at).toISOString(), rendered: row.rendered, delivered: row.delivered, cited: row.cited })).filter(row => !entry || row.key.entryId === entry);
   }
   reject(id: string, context: { project: string; actor: "person" | "agent"; verdict: CandidateVerdict }): void {
@@ -146,7 +150,7 @@ export class CandidateStore {
       const candidate = this.get(id, context.project);
       if (!candidate) throw new Error("candidate unavailable");
       if (candidate.status === "accepted" || candidate.status === "accepting") throw new Error("candidate acceptance already started; inspect its ordinary note before any further action");
-      this.db.query("UPDATE candidates SET status = 'rejected' WHERE id = ? AND project = ? AND status = 'pending'").run(id, context.project);
+      this.db.query("UPDATE candidates SET status = 'rejected' WHERE id = ? AND project IN (SELECT value FROM json_each(?)) AND status = 'pending'").run(id, this.scope(context.project));
     }).immediate();
   }
   accept(id: string, context: CandidateAcceptance): CandidateAcceptanceResult {
@@ -185,7 +189,7 @@ export class CandidateStore {
         if (!current) throw new Error("candidate unavailable");
         if (current.status === "accepted") return current.acceptedNoteId!;
         if (current.status !== "pending") throw new Error("candidate is rejected or acceptance was interrupted; no automatic replay");
-        this.db.query("UPDATE candidates SET status = 'accepting' WHERE id = ? AND project = ?").run(id, context.project);
+        this.db.query("UPDATE candidates SET status = 'accepting' WHERE id = ? AND project IN (SELECT value FROM json_each(?))").run(id, this.scope(context.project));
         return undefined;
       }).immediate();
       if (started) return { candidateId: id, noteId: started, alreadyAccepted: true };
@@ -193,7 +197,7 @@ export class CandidateStore {
       // automatic replay; add explicit person-audited recovery before offering background acceptance retries.
       const noteId = append();
       if (data.kind === "correction" && !context.store.supersede(target!.id, noteId, "person", context.project)) throw new Error("candidate replacement refused; inspect the accepted note before recovery");
-      this.db.query("UPDATE candidates SET status = 'accepted', note_id = ? WHERE id = ? AND project = ?").run(noteId, id, context.project);
+      this.db.query("UPDATE candidates SET status = 'accepted', note_id = ? WHERE id = ? AND project IN (SELECT value FROM json_each(?))").run(noteId, id, this.scope(context.project));
       return { candidateId: id, noteId, alreadyAccepted: false };
     });
   }

package/src/memory/capacity.ts

@@ -1,8 +1,10 @@
 import { spawnSync } from "node:child_process";
-import { appendFileSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync } from "node:fs";
 import { totalmem } from "node:os";
 import { join } from "node:path";
 import { memoryBase } from "./home.ts";
+import { readMetrics, type MetricSample } from "./metrics.ts";
+export { appendMetrics, readMetrics, metricsPath, type MetricSample } from "./metrics.ts";
 import { walkShards } from "./catalog.ts";
 import { captureShardGrowth, captureShardStats, readCaptureConfigFile, CAPTURE_DEFAULT_CAP_MB, CAPTURE_DEFAULT_RETENTION_DAYS, type CaptureConfig } from "./capture.ts";
 
@@ -11,49 +13,16 @@ import { captureShardGrowth, captureShardStats, readCaptureConfigFile, CAPTURE_D
  * `amem capacity` CLI renders it and `amem capacity apply` writes the home default config after a preview. An
  * agent may read the proposal through this library function; applying stays person-only at the CLI.
  *
- * Proposal rule (owner decision, 2026-10-17): P1 is shrink-only — the proposed cap and retention are the largest
- * values not exceeding the current ones whose projection stays within the disk-share bound (default 2% of free
- * space, configurable) and whose measured search and hook readings stay within R2/R3. Growth proposals are a
- * follow-up after the agent-hub release; growing in P1 is the person's explicit `amem capacity apply --cap-mb N`.
- * The reason names the binding constraint: `disk-share retention`, `disk-share cap`, `R3 search RSS`, `R2 hook cost`, or `none`.
+ * Proposal rule (owner decision, 2026-10-17, item 2): the proposed cap and retention are the largest values whose projection stays within the
+ * disk-share bound (default 2% of free space, configurable) and whose measured search and hook readings stay within R2/R3, and they may be above
+ * the current ones. The cap is the disk-share bound itself; retention is the share over the daily growth, up to a 365-day ceiling. R2 halves the cap
+ * and R3 halves the retention. The reason names every binding constraint: `disk-share retention` or `retention ceiling`, `disk-share cap`,
+ * `R3 search RSS`, `R2 hook cost`. The advisor never writes: applying stays person-only, preview first.
  *
  * Metrics: a small rolling `metrics.jsonl` in the memory home (not a memory log: it is trimmed, never synced).
  * `scripts/measure-budget.ts` writes only to its synthetic home; the P3 hooks will append real samples per invocation.
  */
 
-export interface MetricSample { at: string; kind: "hook" | "search"; wallMs?: number; rssMB?: number; idleMB?: number }
-const METRICS_MAX_BYTES = 64 * 1024, METRICS_KEEP = 200;
-
-export function metricsPath(base: string): string {
-  return join(base, "metrics.jsonl");
-}
-
-/** Append samples, trimming the rolling file when it outgrows its bound (newest samples win). */
-export function appendMetrics(base: string, samples: MetricSample[]): void {
-  mkdirSync(base, { recursive: true, mode: 0o700 });
-  const file = metricsPath(base);
-  appendFileSync(file, samples.map((s) => JSON.stringify(s)).join("\n") + "\n", { mode: 0o600 });
-  try {
-    if (statSync(file).size <= METRICS_MAX_BYTES) return;
-    const lines = readFileSync(file, "utf8").split("\n").filter(Boolean).slice(-METRICS_KEEP);
-    writeFileSync(file, lines.join("\n") + "\n", { mode: 0o600 });
-  } catch { /* a trim failure loses nothing: the file simply stays larger */ }
-}
-
-/** The newest samples first-preserved order (oldest to newest); malformed lines are skipped. */
-export function readMetrics(base: string, limit = METRICS_KEEP): MetricSample[] {
-  let lines: string[] = [];
-  try { lines = readFileSync(metricsPath(base), "utf8").split("\n").filter(Boolean); } catch { return []; }
-  const out: MetricSample[] = [];
-  for (const line of lines.slice(-limit)) {
-    try {
-      const s = JSON.parse(line) as MetricSample;
-      if ((s?.kind === "hook" || s?.kind === "search") && typeof s.at === "string") out.push(s);
-    } catch { /* a malformed line is skipped */ }
-  }
-  return out;
-}
-
 const p95 = (samples: number[]): number | null => samples.length ? [...samples].sort((a, b) => a - b)[Math.max(0, Math.ceil(samples.length * 0.95) - 1)]! : null;
 
 function diskReadings(path: string): { freeBytes: number; totalBytes: number } {
@@ -93,6 +62,8 @@ export interface CapacityReport {
 }
 
 const MB = 1048576, GROWTH_DAYS = 7, PROJECT_DAYS = 30;
+// ponytail: the advisor never proposes more than a year of retention. The ceiling keeps a quiet home's proposal finite; the upgrade path is a person setting (a configured ceiling) once someone wants longer.
+const RETENTION_CEILING_DAYS = 365;
 
 export function capacityReport(opts: {
   home?: string; memoryDir?: string; diskShare?: number; now?: () => number;
@@ -133,16 +104,20 @@ export function capacityReport(opts: {
   // ponytail: the 2026-10-17 owner decision keeps R6 caps per shard in P1, while the disk-share budget is
   // machine-wide; #15 T5 (D7) owns the machine-total split. Until then a home with N shards can hold N x cap.
   const budgetBytes = diskShare * disk.freeBytes;
-  let { capMb, retentionDays } = current;
+  // Growth (owner decision 2026-10-17, item 2): propose the largest cap and retention that fit the disk share, above the current values when there is room.
+  // The cap's ceiling is the disk-share bound itself. A person's own setting above the retention ceiling is never proposed down for the ceiling alone.
+  const retentionCeiling = Math.max(RETENTION_CEILING_DAYS, current.retentionDays);
+  let capMb = Math.max(1, Math.floor(budgetBytes / MB));
+  let retentionDays = retentionCeiling;
   const binding: string[] = [];
-  if (bytesPerDay > 0 && bytesPerDay * retentionDays > budgetBytes) {
-    retentionDays = Math.max(1, Math.floor(budgetBytes / bytesPerDay));
-    binding.push("disk-share retention: steady-state capture at the current growth exceeds the disk-share bound");
-  }
-  if (capMb * MB > budgetBytes) {
-    capMb = Math.max(1, Math.floor(budgetBytes / MB));
-    binding.push("disk-share cap: the cap exceeds the disk-share bound");
+  const fitDays = bytesPerDay > 0 ? Math.floor(budgetBytes / bytesPerDay) : Infinity;
+  if (fitDays < retentionCeiling) {
+    retentionDays = Math.max(1, fitDays);
+    binding.push("disk-share retention: steady-state capture at the current growth fills the disk-share bound");
+  } else {
+    binding.push(`retention ceiling: ${retentionCeiling} days fit the disk share, so the ceiling stops growth`);
   }
+  binding.push("disk-share cap: the cap is the largest size the disk-share bound allows");
   if (metrics.searchRssMB !== null && metrics.searchRssMB > 200) {
     retentionDays = Math.max(1, Math.floor(retentionDays / 2));
     binding.push("R3 search RSS: measured peak search memory exceeds 200 MB");
@@ -151,7 +126,7 @@ export function capacityReport(opts: {
     capMb = Math.max(1, Math.floor(capMb / 2));
     binding.push("R2 hook cost: measured hook latency or RSS exceeds the budget");
   }
-  const reason = binding.length ? binding.join("; ") : "none: current bounds fit the disk share and the measured R2/R3 readings";
+  const reason = binding.join("; ");
   return {
     at: new Date(now()).toISOString(),
     capture: { shards: shards.length, bytes, rows, rowsPerDay, bytesPerDay },

package/src/memory/capture-input.ts

@@ -0,0 +1,31 @@
+import { looksSecret } from "./screen.ts";
+import { isDenied } from "./platform.ts";
+
+export const CAPTURE_MAX_EXCERPT = 2000;
+export const CAPTURE_MAX_PATHS = 32;
+const ROW_OVERHEAD_BYTES = 96;
+
+export interface CaptureFields {
+  agent: string; event: string;
+  tool?: string; paths?: string[]; status?: string; excerpt?: string;
+  /** Tests and the spool replay pin the time; hooks leave it to the store clock. */
+  at?: string;
+}
+export interface NormalizedCaptureFields {
+  at: string; agent: string; event: string;
+  tool: string | null; paths: string[]; status: string | null; excerpt: string; bytes: number;
+}
+
+/** Pure capture shaping; no store, project lookup or filesystem operation is loaded or invoked here. */
+export function normalizeCaptureFields(input: CaptureFields, now: () => number = Date.now, screen: (text: string) => boolean = looksSecret): NormalizedCaptureFields {
+  const str = (v: unknown, max: number) => typeof v === "string" && v.length > 0 && v.length <= max;
+  // Canonical UTC ISO text, so text order is time order for eviction (`at < cutoff`) and search (`at >= notBefore`).
+  const at = new Date(input.at === undefined ? now() : Date.parse(input.at)).toISOString();
+  const tool = str(input.tool, 64) ? input.tool! : null;
+  const status = str(input.status, 64) ? input.status! : null;
+  const paths = (input.paths ?? []).map(String).filter((p) => p && !isDenied(p)).slice(0, CAPTURE_MAX_PATHS).map((p) => p.slice(0, 400));
+  let excerpt = (input.excerpt ?? "").slice(0, CAPTURE_MAX_EXCERPT);
+  if (excerpt && screen(excerpt)) excerpt = "[secret-screened]";
+  return { at, agent: input.agent, event: input.event, tool, paths, status, excerpt,
+    bytes: Buffer.byteLength(excerpt) + Buffer.byteLength(JSON.stringify(paths)) + ROW_OVERHEAD_BYTES };
+}