@staix/agent-mem 0.8.0 → 0.10.0

package/src/memory/capture.ts

@@ -359,7 +359,7 @@ export class CaptureStore {
     this.db.run("CREATE TRIGGER IF NOT EXISTS rows_ad AFTER DELETE ON rows BEGIN INSERT INTO fts (fts, rowid, body) VALUES ('delete', old.id, old.excerpt); END");
     this.db.run("CREATE TRIGGER IF NOT EXISTS rows_au AFTER UPDATE ON rows BEGIN INSERT INTO fts (fts, rowid, body) VALUES ('delete', old.id, old.excerpt); INSERT INTO fts (rowid, body) VALUES (new.id, new.excerpt); END");
     // Rows written before FTS existed (or before a platform gained it) are indexed once; triggers keep it level.
-    if (!had && (this.db.query("SELECT COUNT(*) AS n FROM rows").get() as { n: number }).n > 0) this.db.run("INSERT INTO fts (fts) VALUES ('rebuild')");
+    if (!had && (this.db.query("SELECT COUNT(*) AS n FROM rows").get() as { n: number }).n > 0) this.db.run("INSERT INTO fts (rowid, body) SELECT id, excerpt FROM rows");
   }
 
   private mcpReady = false;
@@ -619,17 +619,15 @@ export class CaptureStore {
   /** Exact-project, bounded body pages; MCP screens before filling its public candidate window. */
   readPage(window: ReadWindow & { query?: string; match?: "substring" }): { rows: CaptureRow[]; next?: ReadRef; engine?: "fts5" | "substring" } {
     this.checkReadBinding();
-    const { columns, where, bind } = readWindowSql(window, "id");
+    const { columns, where, bind } = readWindowSql(window, "id", "integer");
     if (this.recentReadIds) {
       if (window.query !== undefined) throw new Error("recent capture brief does not support query indexes");
       where.push("id IN (SELECT value FROM json_each(?))"); bind.push(JSON.stringify(this.recentReadIds));
     }
     const engine = window.query === undefined ? undefined : window.match !== "substring" && this.ensureMcpFts() ? "fts5" : "substring";
-    if (window.query !== undefined && engine === "fts5") {
-      const match = ftsTerms(window.query); if (!match) return { rows: [], engine };
-      where.push("id IN (SELECT rowid FROM mcp_fts WHERE mcp_fts MATCH ?)"); bind.push(match);
-    }
-    const rows = this.db.query(`SELECT *, ${columns} FROM rows WHERE ${where.join(" AND ")} ORDER BY candidate_position, candidate_id LIMIT ?`)
+    const plan = captureReadPlan(window, engine, where, bind);
+    if (!plan) return { rows: [], engine };
+    const rows = this.db.query(`SELECT rows.*, ${columns} FROM ${plan.from} WHERE ${where.join(" AND ")} ORDER BY ${plan.order} LIMIT ?`)
       .all(...bind, window.limit) as (RawRow & { candidate_id: string; candidate_position: number })[];
     return { rows: rows.map(toRow), ...(engine ? { engine } : {}), ...(rows.length ? { next: readRef(rows[rows.length - 1]!) } : {}) };
   }
@@ -644,6 +642,26 @@ export class CaptureStore {
   close(): void { this.db.close(); }
 }
 
+/** Keep chronological readers intact while exhaustive search consumes FTS's rowid range directly. */
+function captureReadPlan(window: ReadWindow & { query?: string; match?: "substring" }, engine: "fts5" | "substring" | undefined,
+  where: string[], bind: (string | number)[]): { from: string; order: string } | undefined {
+  let from = "rows", order = "candidate_position, candidate_id";
+  if (window.query !== undefined && engine === "fts5") {
+    const match = ftsTerms(window.query); if (!match) return;
+    if (window.order === "id") {
+      from = "mcp_fts JOIN rows ON rows.id = mcp_fts.rowid"; order = "mcp_fts.rowid";
+      where.push("mcp_fts MATCH ?"); bind.push(match);
+      if (window.after) {
+        const cursor = where.indexOf("id > ?");
+        if (cursor < 0) throw Error("missing capture identity cursor");
+        // Qualify the existing predicate so FTS receives the rowid range, without a second condition/bind.
+        where[cursor] = "mcp_fts.rowid > ?";
+      }
+    } else { where.push("id IN (SELECT rowid FROM mcp_fts WHERE mcp_fts MATCH ?)"); bind.push(match); }
+  }
+  return { from, order };
+}
+
 /** One shard's capture totals for the catalog and the capacity advisor, without opening a writer. */
 export function captureShardStats(dir: string): { rows: number; bytes: number; lastAt: string | null } {
   if (!existsSync(join(dir, "capture.db"))) return { rows: 0, bytes: 0, lastAt: null };

package/src/memory/commands.ts

@@ -15,6 +15,8 @@ export const AMEM_NAMES: CommandNames = { memory: "amem", goal: "amem goal" };
 export interface MemoryCommandOptions {
   /** Host-authenticated person intent. Never accept this from model arguments. Required for retained history/as-of. */
   person?: boolean;
+  /** Standalone person CLI opt-in. Hosts omit this to retain their screened substring recall. */
+  rankedSearch?: boolean;
   /** Defaults to amem's own names. */
   names?: CommandNames;
   /** Startup-bound canonical project supplied by a host; no model-facing selector. */
@@ -47,7 +49,7 @@ export interface GoalCommandOptions {
  * supersede and rebuild are a person's (the identity gate refuses agent shells).
  */
 /** The usage line of the memory commands under `name` (`amem` by default; agent-hub passes `ahub memory`). */
-export const memoryUsage = (name: string = AMEM_NAMES.memory): string => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
+export const memoryUsage = (name: string = AMEM_NAMES.memory): string => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
 export const MEMORY_USAGE = memoryUsage();
 /** The usage line of the goal commands under `name` (`amem goal` by default; agent-hub passes `ahub goal`). */
 export const goalUsage = (name: string = AMEM_NAMES.goal): string => `usage: ${name} [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]`;
@@ -67,6 +69,7 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
   const sub = rest[0] && !rest[0].startsWith("--") ? rest.shift()! : "list";
   const names = opts.names ?? AMEM_NAMES, usage = memoryUsage(names.memory);
   if (args.some(arg => arg === "--history" || arg === "--as-of" || arg.startsWith("--history=") || arg.startsWith("--as-of=")) && opts.person !== true) fail("historical recall requires authenticated person intent from the host");
+  if (opts.rankedSearch && opts.person !== true) fail("ranked CLI search requires person intent");
   const store = opts.store ?? opts.open();
   const actor = "user";
   const project = opts.project ?? memoryProjectKey(cwd);
@@ -89,8 +92,14 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
         if (kind && !KINDS.includes(kind as Kind)) fail(`--kind takes ${KINDS.join(", ")}`);
         if (limit && !(Number(limit) > 0)) fail("--limit takes a positive number");
         const q = sub === "search" ? rest.join(" ") : undefined;
-        const state = recallRows(store, project, { person: opts.person, history, asOf, query: q, limit: Number.MAX_SAFE_INTEGER });
-        const all = state.views.filter(view => (!tier || view.tier === tier) && (!kind || view.kind === kind) && (!peer || view.peer === peer) && (!machine || view.machine === machine) && (!since || Date.parse(view.at) >= Date.parse(since)));
+        const ranked = opts.rankedSearch && q?.trim() && !history && asOf === undefined;
+        const state = recallRows(store, project, { person: opts.person, history, asOf, query: ranked ? undefined : q, limit: Number.MAX_SAFE_INTEGER });
+        // Retained history has its own snapshot; the current index cannot rank it. Empty queries keep list semantics.
+        // ponytail: fetch up to the current curated-view count before display caps, so metadata/readable exclusions consume no slots.
+        // Upgrade to paged ranked views if this full-pool person read reaches the R3 ceiling.
+        const candidates = ranked ? store.withDeferredPromotions(() => store.search(q!, { project, includeCapture: false, limit: Math.max(1, state.views.length) }))
+          .hits.flatMap(hit => hit.view ? [hit.view] : []) : state.views;
+        const all = candidates.filter(view => (!tier || view.tier === tier) && (!kind || view.kind === kind) && (!peer || view.peer === peer) && (!machine || view.machine === machine) && (!since || Date.parse(view.at) >= Date.parse(since)));
         const readable = opts.readable(all), rows = readable.slice(0, limit ? Number(limit) : 50);
         ready(rows);
         if (history || asOf !== undefined) {
@@ -154,7 +163,7 @@ export async function rawMemoryCommand(args: string[], cwd: string, opts: Memory
         const db = flag("--db"), limit = flag("--limit");
         const restart = rest.includes("--restart");
         if (restart) rest.splice(rest.indexOf("--restart"), 1);
-        if (rest[0] !== "claude-mem" || rest.length !== 1) fail(`usage: ${names.memory} import claude-mem [--db <path>] [--limit N] [--restart]`);
+        if (rest[0] !== "claude-mem" || rest.length !== 1) fail(`usage: ${names.memory} import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N]`);
         if (limit && !(Number(limit) > 0)) fail("--limit takes a positive number");
         const isPii = opts.importPolicy();
         const key = opts.project ?? memoryProjectKey(cwd);

package/src/memory/eval.ts

@@ -88,7 +88,7 @@ export interface EvalQuestionResult {
 /** `recall` and `hit` are null when no question counts (no answerable question), never 0: an empty average is not a measured zero. */
 export interface EvalAggregate { questions: number; recall: Record<number, number | null>; hit: Record<number, number | null>; mrr: number | null }
 export interface EvalReport {
-  /** The search that was scored: the ranked, project-scoped `store.search` (BM25 with tier and recency weights) that MCP and hub recall use, NOT the `amem search` command's substring filter. */
+  /** Ranked project-scoped `store.search` (BM25 with tier and recency weights), the engine used by default current curated `amem search`; `--filter` keeps legacy substring matching. */
   engine: string;
   ks: number[];
   /** Every question. A question whose expected entry is not in the store scores 0, as a search that cannot find it would. */
@@ -142,7 +142,7 @@ const pct = (value: number | null): string => value === null ? "  n/a" : value.t
 export function evalText(report: EvalReport, label: string): string {
   const head = (name: string, row: EvalAggregate) => `${name.padEnd(11)} ${String(row.questions).padStart(4)}  ${report.ks.map(k => `${pct(row.recall[k] ?? null)}/${pct(row.hit[k] ?? null)}`.padStart(13)).join(" ")}  ${pct(row.mrr).padStart(6)}`;
   return [
-    `eval: ${label} (${report.engine === "substring" ? "substring fallback" : "ranked store.search, engine " + report.engine}; this is the ranking MCP and hub recall use, not the \`amem search\` filter)`,
+    `eval: ${label} (${report.engine === "substring" ? "substring fallback" : "ranked store.search, engine " + report.engine}; same ranked search path as default \`amem search\`; \`--filter\` keeps legacy substring matching)`,
     `${"".padEnd(11)} ${"n".padStart(4)}  ${report.ks.map(k => `@${k} recall/hit`.padStart(13)).join(" ")}  ${"MRR".padStart(6)}`,
     head("all", report.all),
     head("answerable", report.answerable),

package/src/memory/import.ts

@@ -7,6 +7,11 @@ import { join } from "node:path";
 import { KINDS, looksSecret, type Kind, type MemoryStore } from "./store.ts";
 import { aliasedKeys, resolveAlias } from "./shard.ts";
 import { WorkListStore, type WorkListFields, type WorkListPolicy } from "./work-lists.ts";
+import { CaptureStore, type CaptureInput } from "./capture.ts";
+import { CAPTURE_MAX_EXCERPT } from "./capture-input.ts";
+import { configuredPolicyOptions } from "./config.ts";
+import { createStandalonePolicy, type StandalonePolicyOptions } from "./policy.ts";
+import { stripPrivateSpans } from "./private-spans.ts";
 
 /** The claude-mem store is another program's: opened read-only, never written, its locks waited on briefly. */
 export const CLAUDE_MEM_BUSY_TIMEOUT_MS = 3000;
@@ -15,6 +20,92 @@ const MODEL_ANSWER = "ahub ask (model answer)";
 
 export interface ImportResult { read: number; added: number; skipped: { model: number; pii: number; secret: number }; more: boolean; cursor: number }
 export interface WorkStateImportResult { read: number; added: number; skipped: { invalid: number; policy: number }; more: boolean; cursor: number }
+export interface CaptureImportResult { read: number; added: number; spooled: number; skipped: number; more: boolean }
+
+type ClaudeMemCaptureRow = { id: number; created_at_epoch: number; origin_device_id: string | null; origin_local_id: string | null } & Record<string, any>;
+const CLAUDE_MEM_CAPTURE_KINDS = [
+  { table: "observations", event: "observation", columns: "id, title, text, narrative, created_at_epoch" },
+  { table: "session_summaries", event: "summary", columns: "id, request, investigated, learned, completed, next_steps, notes, created_at_epoch" },
+] as const;
+type ClaudeMemCaptureKind = typeof CLAUDE_MEM_CAPTURE_KINDS[number];
+interface ClaudeMemCaptureContext {
+  db: Database; store: CaptureStore; policy: ReturnType<typeof createStandalonePolicy>;
+  aliases: string[]; project: string; sourceMachine: string; cutoff: number; limit: number;
+}
+
+function claudeMemCaptureText(row: ClaudeMemCaptureRow, kind: ClaudeMemCaptureKind): string {
+  if (kind.table === "observations") return stripPrivateSpans([row.title, row.text ?? row.narrative].filter(value => typeof value === "string" && value.trim()).join("\n")).trim();
+  const fields = [["Request", row.request], ["Investigated", row.investigated], ["Learned", row.learned], ["Completed", row.completed], ["Next steps", row.next_steps], ["Notes", row.notes]];
+  return stripPrivateSpans(fields.filter(([, value]) => typeof value === "string" && value.trim()).map(([label, value]) => `${label}: ${value}`).join("\n")).trim();
+}
+
+async function appendClaudeMemCapture(row: ClaudeMemCaptureRow, kind: ClaudeMemCaptureKind, context: ClaudeMemCaptureContext): Promise<"added" | "spooled" | "skipped"> {
+  const text = claudeMemCaptureText(row, kind);
+  if (!text || !Number.isFinite(row.created_at_epoch)) return "skipped";
+  let at: string;
+  try { at = new Date(row.created_at_epoch).toISOString(); } catch { return "skipped"; }
+  const input: CaptureInput = { project: context.project, agent: "claude-mem", event: kind.event, excerpt: text, at };
+  if (!await context.policy.screen(input)) return "skipped";
+  input.excerpt = text.slice(0, CAPTURE_MAX_EXCERPT);
+  const synced = typeof row.origin_device_id === "string" && !!row.origin_device_id && typeof row.origin_local_id === "string" && !!row.origin_local_id;
+  const receipt = createHash("sha256").update(JSON.stringify(["claude-mem", kind.table, synced ? row.origin_device_id : context.sourceMachine, synced ? row.origin_local_id : String(row.id)])).digest("hex");
+  const appended = context.store.append(input, { receipt });
+  return "spooled" in appended ? "spooled" : appended.already ? "skipped" : "added";
+}
+
+async function importClaudeMemCaptureTable(kind: ClaudeMemCaptureKind, context: ClaudeMemCaptureContext, initial: number, onCursor: (cursor: number) => void): Promise<CaptureImportResult> {
+  const result: CaptureImportResult = { read: 0, added: 0, spooled: 0, skipped: 0, more: false };
+  const columns = new Set((context.db.query(`PRAGMA table_info(${kind.table})`).all() as { name: string }[]).map(row => row.name));
+  const origin = columns.has("origin_device_id") && columns.has("origin_local_id"), where = `project IN (${context.aliases.map(() => "?").join(",")})`;
+  const max = context.db.query(`SELECT MAX(id) AS id FROM ${kind.table} WHERE ${where}`).get(...context.aliases) as { id: number | null };
+  let cursor = (max.id ?? 0) < initial ? 0 : initial; onCursor(cursor);
+  const rows = context.db.query(`SELECT ${kind.columns}${origin ? ", origin_device_id, origin_local_id" : ", NULL AS origin_device_id, NULL AS origin_local_id"} FROM ${kind.table} WHERE ${where} AND created_at_epoch >= ? AND id > ? ORDER BY id LIMIT ?`)
+    .all(...context.aliases, context.cutoff, cursor, context.limit) as ClaudeMemCaptureRow[];
+  result.read = rows.length; result.more = rows.length === context.limit;
+  for (const row of rows) {
+    result[await appendClaudeMemCapture(row, kind, context)]++;
+    cursor = row.id; onCursor(cursor);
+  }
+  return result;
+}
+
+/** Import only reviewed aliases into machine-local capture. ponytail: --limit is per source table; a merged cursor could add one combined ceiling. */
+export async function importClaudeMemCapture(opts: { base: string; project: string; cwd: string; days: number; db?: string; limit?: number; restart?: boolean; now?: number; policy?: StandalonePolicyOptions; log?: (line: string) => void }): Promise<CaptureImportResult> {
+  const file = opts.db ?? join(homedir(), ".claude-mem", "claude-mem.db"), limit = opts.limit ?? 10_000;
+  if (!existsSync(file)) throw new Error(`no claude-mem store at ${file}`);
+  if (!Number.isSafeInteger(opts.days) || opts.days <= 0) throw new Error("--capture-days takes a positive integer");
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error("--limit takes a positive integer");
+  const now = opts.now ?? Date.now(); if (!Number.isFinite(now)) throw new Error("capture import clock unavailable");
+  const project = resolveAlias(opts.base, opts.project), aliases = aliasedKeys(opts.base, project);
+  const result: CaptureImportResult = { read: 0, added: 0, spooled: 0, skipped: 0, more: false };
+  if (!aliases.length) return result;
+  const db = new Database(file, { readonly: true });
+  let store: CaptureStore | undefined, state: string | undefined;
+  const progress = new Map<string, number>();
+  try {
+    db.run(`PRAGMA busy_timeout = ${CLAUDE_MEM_BUSY_TIMEOUT_MS}`);
+    const available = CLAUDE_MEM_CAPTURE_KINDS.filter(kind => db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(kind.table));
+    if (!available.length) return result;
+    store = new CaptureStore({ memoryDir: opts.base, project, cwd: opts.cwd, now: () => now });
+    state = join(store.dir, "import-state.json");
+    const context: ClaudeMemCaptureContext = { db, store, aliases, project, limit,
+      sourceMachine: createHash("sha256").update(realPath(file)).digest("hex"), cutoff: Math.max(0, now - opts.days * 86_400_000),
+      policy: createStandalonePolicy(configuredPolicyOptions(opts.base, opts.cwd, opts.policy)) };
+    const cursors = readCursors(state);
+    for (const kind of available) {
+      const key = createHash("sha256").update(JSON.stringify([context.sourceMachine, aliases, project, kind.table])).digest("hex");
+      progress.set(key, opts.restart ? 0 : cursors[key] ?? 0);
+      const imported = await importClaudeMemCaptureTable(kind, context, progress.get(key)!, cursor => progress.set(key, cursor));
+      for (const field of ["read", "added", "spooled", "skipped"] as const) result[field] += imported[field];
+      result.more ||= imported.more;
+    }
+  } finally {
+    db.close();
+    if (state) for (const [key, cursor] of progress) writeCursor(state, key, cursor, opts.log ?? console.error);
+    store?.close();
+  }
+  return result;
+}
 
 /**
  * Import only the source project names explicitly mapped by the person's D2 alias table. A basename or even

package/src/memory/platform.ts

@@ -49,13 +49,17 @@ export function realPath(path: string): string {
 export const DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/archive"];
 /** Regex sources, matched against a file's basename. */
 export const DENY_NAMES = ["^\\.env", "\\.pem$", "\\.key$", "^id_rsa", "^id_ed25519", "^credentials(\\.|$)", "^auth\\.json$", "^\\.netrc$", "^\\.npmrc$", "^\\.pypirc$"];
+const denyNamePatterns = new Map(DENY_NAMES.map(source => [source, new RegExp(source)]));
 
 const hasSegment = (rel: string, seg: string) => `/${rel}/`.includes(`/${seg}/`);
 
 /** True when a path names something the worker must never read, write or report. `extra`: substrings from `local.deny`. */
 export function isDenied(path: string, extra: string[] = []): boolean {
   const norm = path.split(sep).join("/");
-  return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
+  if (DENY_SEGMENTS.some((s) => hasSegment(norm, s))) return true;
+  const name = basename(norm);
+  // Reuse the fixed patterns without caching arbitrary additions to the exported list.
+  return DENY_NAMES.some((re) => (denyNamePatterns.get(re) ?? new RegExp(re)).test(name)) || extra.some((e) => e && norm.includes(e));
 }
 
 /**

package/src/memory/policy.ts

@@ -1,7 +1,7 @@
 import { posix } from "node:path";
 import { types } from "node:util";
 import { looksSecret } from "./screen.ts";
-import { isDenied } from "./platform.ts";
+import { DENY_NAMES, DENY_SEGMENTS, isDenied } from "./platform.ts";
 import { nodePath, pathCandidates } from "./project.ts";
 
 /** True means the complete value is public. Hosts may narrow, never replace, standalone policy. */
@@ -99,6 +99,7 @@ function literals(value: unknown, label: string): string[] {
 
 function defaultPii(text: string): boolean {
   if (/\b(?:\d{6}-\d{7}|\d{3}-\d{2}-\d{4})\b/.test(text)) return true;
+  if (!text.includes("@")) return false;
   // Bound each email candidate before matching; arbitrary user regexes are never run.
   for (const token of text.split(/[\s<>()\[\]{}",;:]+/)) if (token.includes("@")) {
     if (token.length > 320 || /[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/i.test(token)) return true;
@@ -106,6 +107,51 @@ function defaultPii(text: string): boolean {
   return false;
 }
 
+interface DefaultPathProbe { names: string[]; segments: string[] }
+
+/** A mandatory literal, not a deny verdict. All other regex grammar uses the canonical checker. */
+function necessaryDenyLiteral(source: string): string | undefined {
+  if (source.length > 256) return;
+  let index = source.startsWith("^") ? 1 : 0, literal = "";
+  for (; index < source.length; index++) {
+    const character = source[index]!;
+    if (/^[A-Za-z0-9_-]$/.test(character)) literal += character;
+    else if (character === "\\" && source[index + 1] === ".") { literal += "."; index++; }
+    else break;
+  }
+  const rest = source.slice(index);
+  return literal && (rest === "" || rest === "$" || rest === "(\\.|$)") ? literal : undefined;
+}
+
+/** Do not add getter reads or assumptions about malformed/mutated exported defaults. */
+function plainDefaultStrings(values: readonly string[]): boolean {
+  if (types.isProxy(values) || !Array.isArray(values) || Object.getPrototypeOf(values) !== Array.prototype || values.length > 64 || Object.getOwnPropertySymbols(values).length || "toJSON" in values) return false;
+  if (Object.getOwnPropertyNames(values).length !== values.length + 1) return false;
+  for (let index = 0; index < values.length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(values, String(index));
+    if (!descriptor || !("value" in descriptor) || typeof descriptor.value !== "string") return false;
+  }
+  return true;
+}
+
+function defaultPathProbe(): DefaultPathProbe | undefined {
+  const needles = DENY_NAMES.map(necessaryDenyLiteral);
+  return needles.every((value): value is string => value !== undefined) ? { names: needles, segments: [...DENY_SEGMENTS] } : undefined;
+}
+
+function containsPathLiteral(text: string, probe: DefaultPathProbe, deny: readonly string[]): boolean {
+  return text.includes("/.") || text.includes("//") || deny.some(entry => text.includes(entry))
+    || probe.segments.some(entry => text.includes(entry)) || probe.names.some(needle => text.includes(needle));
+}
+
+function mayNeedPathCheck(text: string, probe: DefaultPathProbe | undefined, deny: readonly string[]): boolean {
+  if (!probe || containsPathLiteral(text, probe, deny)) return true;
+  // Raw/node/token paths are substrings of text; pathCandidates takes substrings after NFC.
+  // Inspect both: removing ignorables or lowercasing after NFKC can leave a non-NFC result.
+  const canonical = text.normalize("NFC");
+  return canonical !== text && containsPathLiteral(canonical, probe, deny);
+}
+
 /** No filesystem, model, network or storage work occurs while constructing or screening this policy. */
 export function createStandalonePolicy(options: StandalonePolicyOptions = {}): StandalonePolicy {
   if (!options || typeof options !== "object" || types.isProxy(options) || Object.getPrototypeOf(options) !== Object.prototype || Object.getOwnPropertySymbols(options).length) throw new Error("invalid standalone policy options");
@@ -115,18 +161,51 @@ export function createStandalonePolicy(options: StandalonePolicyOptions = {}): S
   const pii = literals(descriptors.piiPatterns?.value, "PII patterns");
   const host = descriptors.host?.value as MemoryPolicy | undefined;
   if (host !== undefined && (!host || typeof host.screen !== "function")) throw new Error("invalid host policy");
+  // ponytail: retain at most 512 exact strings / 64 KiB per immutable policy configuration.
+  // Evict the batch when full; a measured need for better hit rates can upgrade this to an LRU.
+  const textChecks = new Map<string, boolean>(); let textBytes = 0;
+  let defaultDenyRevision = "";
+  // ponytail: the negative probe supports at most 64 dense default entries and 256-character simple name sources.
+  // Everything else falls back; extend the grammar only with differential proof, never an approximate verdict.
+  let pathProbe: DefaultPathProbe | undefined;
+  let defaultsWerePlain = false;
+  const publicText = (text: string): boolean => {
+    const cached = textChecks.get(text);
+    if (cached !== undefined) return cached;
+    const check = () => {
+      if (looksSecret(text)) return false;
+      const unquoted = text.replace(/["']/g, "");
+      if (unquoted !== text && looksSecret(unquoted)) return false;
+      const normalized = fold(text);
+      if (defaultPii(normalized) || pii.some(pattern => normalized.includes(pattern))) return false;
+      if (!mayNeedPathCheck(normalized, pathProbe, deny)) return true;
+      const candidates = normalized.includes("/") || /\.[a-z]/.test(normalized) ? pathCandidates(normalized) : [];
+      const paths = [normalized, nodePath(normalized), ...candidates, ...normalized.split(/[\s"'`(){}\[\],;:=<>]+/)];
+      return ![...new Set(paths)].some(path => path && isDenied(posix.normalize(path), deny));
+    };
+    const allowed = check(), bytes = Buffer.byteLength(text);
+    if (bytes <= 1024) {
+      if (textChecks.size >= 512 || textBytes + bytes > 64 * 1024) { textChecks.clear(); textBytes = 0; }
+      textChecks.set(text, allowed); textBytes += bytes;
+    }
+    return allowed;
+  };
   const standalone = (value: unknown): { ok: boolean; value?: unknown } => {
     try {
+      // The exported default lists can be tightened by a host between calls.
+      // A getter can change behavior without changing its first serialized value: validate shape every time.
+      const defaultsPlain = plainDefaultStrings(DENY_NAMES) && plainDefaultStrings(DENY_SEGMENTS);
+      const revision = JSON.stringify([DENY_NAMES, DENY_SEGMENTS]);
+      const changed = revision !== defaultDenyRevision;
+      if (changed) { textChecks.clear(); textBytes = 0; defaultDenyRevision = revision; }
+      if (!defaultsPlain) pathProbe = undefined;
+      else if (changed || !defaultsWerePlain) pathProbe = defaultPathProbe();
+      defaultsWerePlain = defaultsPlain;
       const complete = snapshot(value);
       if (!complete) return { ok: false };
-      for (const text of complete.texts) {
-        if (looksSecret(text) || looksSecret(text.replace(/["']/g, ""))) return { ok: false };
-        const normalized = fold(text);
-        if (defaultPii(normalized) || pii.some(pattern => normalized.includes(pattern))) return { ok: false };
-        const candidates = normalized.includes("/") || /\.[a-z]/.test(normalized) ? pathCandidates(normalized) : [];
-        const paths = [normalized, nodePath(normalized), ...candidates, ...normalized.split(/[\s"'`(){}\[\],;:=<>]+/)];
-        for (const path of paths) if (path && isDenied(posix.normalize(path), deny)) return { ok: false };
-      }
+      // Only pure text checks are reused. Shape/bounds/private flags and the host's detached
+      // snapshot are fresh on every call; no row or host verdict is cached.
+      for (const text of complete.texts) if (!publicText(text)) return { ok: false };
       return { ok: true, value: complete.value };
     } catch { return { ok: false }; }
   };

package/src/memory/search-fts.ts

@@ -187,6 +187,59 @@ export class SearchIndex {
   close(): void { this.db?.close(); }
 }
 
+/** Screened query-local corpus in SQLite-owned TEMP storage, removed even when the process exits. */
+export class ScreenedSearchIndex<T> {
+  readonly available = fts5Available();
+  private readonly db: Database;
+  private closed = false;
+
+  constructor() {
+    let db: Database | undefined;
+    try {
+      db = new Database(":memory:");
+      // SQLite owns the anonymous TEMP files; no named plaintext cache survives a killed MCP child.
+      if ((db.query("SELECT sqlite_compileoption_used('TEMP_STORE=3') AS memoryOnly").get() as { memoryOnly: number }).memoryOnly) throw Error("disk-backed search unavailable");
+      db.run("PRAGMA temp_store = FILE");
+      db.run(this.available
+        ? "CREATE VIRTUAL TABLE temp.docs USING fts5(body, ref UNINDEXED, tier UNINDEXED, at UNINDEXED, payload UNINDEXED, expires UNINDEXED)"
+        : "CREATE TEMP TABLE docs (body TEXT, ref TEXT, tier TEXT, at TEXT, payload TEXT, expires REAL)");
+      db.run("PRAGMA temp.cache_size = -2048");
+      // A platform spill minimum can exceed cache_size (macOS: 20,000 pages).
+      // Spill at the cache target so dirty TEMP pages cannot accumulate behind that minimum.
+      db.run("PRAGMA temp.cache_spill = 1");
+      this.db = db;
+    } catch (error) { db?.close(); throw error; }
+  }
+
+  append(rows: readonly { body: string; ref: string; tier: string; at: string; value: T; expiresAt?: string | null }[]): void {
+    const insert = this.db.query("INSERT INTO docs (body, ref, tier, at, payload, expires) VALUES (?, ?, ?, ?, ?, ?)");
+    this.db.transaction(() => {
+      for (const row of rows) {
+        const deadline = row.expiresAt == null ? null : Date.parse(row.expiresAt);
+        // Invalid deadlines fail closed; this sentinel predates every representable Date.
+        insert.run(row.body, row.ref, row.tier, row.at, JSON.stringify(row.value), deadline !== null && !Number.isFinite(deadline) ? Number.MIN_SAFE_INTEGER : deadline);
+      }
+    })();
+  }
+
+  best(query: string, limit: number, now: number, useFts = this.available): { value: T; score: number }[] {
+    if (useFts && !ftsTerms(query)) return [];
+    const rank = useFts ? "-bm25(docs)" : "1.0";
+    const instant = new Date(now).toISOString();
+    const where = "WHERE (expires IS NULL OR expires > ?)" + (useFts ? " AND docs MATCH ?" : "");
+    const rows = this.db.query(`SELECT payload, ${rank} * CASE tier WHEN 'long' THEN 1.0 WHEN 'capture' THEN 0.5 ELSE 0.9 END
+      / (1 + max(0, (julianday(?) - julianday(at)) / 30.0)) AS score FROM docs ${where} ORDER BY score DESC, ref LIMIT ?`)
+      .all(instant, now, ...(useFts ? [ftsTerms(query)] : []), limit) as { payload: string; score: number }[];
+    return rows.map(row => ({ value: JSON.parse(row.payload) as T, score: row.score }));
+  }
+
+  close(): void {
+    if (this.closed) return;
+    this.closed = true;
+    this.db.close();
+  }
+}
+
 interface RawCaptureRow { id: number; at: string; project: string; agent: string; event: string; tool: string | null; paths: string; status: string | null; excerpt: string }
 
 /**
@@ -222,20 +275,23 @@ export interface ReadWindow {
   anchor?: string;
   prefix?: string;
   id?: string;
+  /** Exhaustive screened scans need stable identity order, not a chronological relevance window. */
+  order?: "id";
   after?: { position: number; id: string };
 }
 export interface ReadRef { id: string; at: string; position: number }
 /** Fixed column names supplied by the three derived stores; all caller values remain SQL parameters. */
-export function readWindowSql(window: ReadWindow, id: "id" | "ref") {
+export function readWindowSql(window: ReadWindow, id: "id" | "ref", identity: "text" | "integer" = "text") {
   if (!Number.isSafeInteger(window.limit) || window.limit < 1 || window.limit > 256) throw new Error("invalid read page limit");
   const bind: (string | number)[] = [];
-  const position = window.anchor ? (bind.push(window.anchor), "abs(julianday(at) - julianday(?))") : "-julianday(at)";
+  const position = window.order === "id" ? (identity === "integer" ? id : "0") : window.anchor ? (bind.push(window.anchor), "abs(julianday(at) - julianday(?))") : "-julianday(at)";
   const columns = `CAST(${id} AS TEXT) AS candidate_id, at, ${position} AS candidate_position`;
   const where = ["project IN (SELECT value FROM json_each(?))"]; bind.push(JSON.stringify(window.projects ?? [window.project]));
   if (window.since) { where.push("julianday(at) >= julianday(?)"); bind.push(window.since); }
   if (window.id !== undefined) { where.push(`${id} = ?`); bind.push(window.id); }
   if (window.prefix !== undefined) { where.push(`substr(${id}, 1, length(?)) = ?`); bind.push(window.prefix, window.prefix); }
-  if (window.after) {
+  if (window.after && window.order === "id") { where.push(`${id} > ?`); bind.push(window.after.id); }
+  else if (window.after) {
     where.push("(candidate_position > ? OR (candidate_position = ? AND candidate_id > ?))");
     bind.push(window.after.position, window.after.position, window.after.id);
   }

package/src/memory/shard-sync-format.ts

@@ -102,10 +102,9 @@ export function decodeShardPack(path: string, bytes: Uint8Array, realm: ShardSyn
     catch { throw new ShardSyncFormatError(label, "malformed pack row"); }
     const row = publicRow(value, label);
     if (hash(row.machine) !== match[1]) throw new ShardSyncFormatError(label, "pack author mismatch");
-    if (row.op === "prune") {
-      // ponytail: #404 needs a generation-neutral public-witness transport; never retag or skip a foreign prune.
-      if (row.generation !== generation) throw new ShardSyncFormatError(label, "foreign-generation prune");
-    } else if (row.op === "note" || row.op === "goal") {
+    // Generation is preserved in the original prune payload. Acceptance here is structural,
+    // never permission to apply it: the engine proves each original generation and holds foreign rows.
+    if (row.op === "note" || row.op === "goal") {
       if (realm.scope === "project" ? row.scope !== "project" || row.project !== realm.key : row.scope !== "shared") {
         throw new ShardSyncFormatError(label, "row scope mismatch");
       }