hippo-memory 1.69.0 → 1.71.0

package/dist/consolidate/half-life-migration.js

@@ -0,0 +1,89 @@
+/** Moves a store's memories to a new default half-life: only memories still on the old base are rescaled (`deriveHalfLife(from, entry)` plus recall bonus).
+ * Memories hippo shortened since, or with their own fixed half-life, keep theirs; rescales are audit-logged and `meta` records the base, so it runs once. */
+import { deriveHalfLife } from '../core/memory.js';
+import { HALF_LIFE_BASE_META_KEY, LEGACY_TYPED_HALF_LIFE } from '../store/open.js';
+import { moveHalfLives, recordedHalfLifeBase } from '../store/half-life.js';
+const TYPED_SOURCES = new Set(['decision', 'incident', 'process', 'policy', 'skill', 'project_brief', 'customer_note']);
+export { HALF_LIFE_BASE_META_KEY, LEGACY_TYPED_HALF_LIFE };
+/** Recall bonus over `written`, the half-life `entry` got at write, or null when off it; each recall added 2 days. */
+export function halfLifeRecallBonus(entry, written) {
+    if (entry.superseded_by || entry.tags.includes('invalidated') || entry.tags.includes('superseded'))
+        return null;
+    const bonus = entry.half_life_days - written;
+    const k = Math.round(bonus / 2);
+    return Math.abs(bonus - 2 * k) < 1e-9 && k >= 0 && k <= entry.retrieval_count ? bonus : null;
+}
+/** The entries to rescale from `from` to `to`, as copies that keep their recall bonus. Pure. */
+export function planHalfLifeMigration(entries, from, to) {
+    if (from === to)
+        return [];
+    return entries.flatMap((e) => {
+        const bonus = halfLifeRecallBonus(e, deriveHalfLife(from, e));
+        return bonus === null ? [] : [{ ...e, half_life_days: deriveHalfLife(to, e) + bonus }];
+    });
+}
+/** Memories of decisions, incidents and other objects still on the flat 90 days, as copies on `to` that keep their recall bonus. Pure. */
+export function planTypedHalfLifeMigration(entries, to) {
+    return entries.flatMap((e) => {
+        const bonus = TYPED_SOURCES.has(e.source) ? halfLifeRecallBonus(e, LEGACY_TYPED_HALF_LIFE) : null;
+        const next = bonus === null ? e.half_life_days : deriveHalfLife(to, e) + bonus;
+        return next === e.half_life_days ? [] : [{ ...e, half_life_days: next }];
+    });
+}
+/** The base this store's memories are on. */
+export function storeHalfLifeBase(hippoRoot) {
+    return recordedHalfLifeBase(hippoRoot);
+}
+/** Move the store's memories, and those of objects on the old flat 90 days, from their recorded base to `to`, once; `dryRun` writes nothing. */
+export function migrateDefaultHalfLife(hippoRoot, to, opts = {}) {
+    const dryRun = opts.dryRun ?? false;
+    const { from, outcome } = moveHalfLives(hippoRoot, to, { dryRun, actor: opts.actor ?? 'system' }, (rows) => {
+        const { basePlan, typedPlan } = planMoves(rows, to);
+        const plan = [...basePlan, ...typedPlan];
+        return {
+            moves: [{ from: rows.from, to, entries: basePlan }, { from: LEGACY_TYPED_HALF_LIFE, to, entries: typedPlan }],
+            outcome: {
+                rescaled: basePlan.length,
+                typed: typedPlan.length,
+                kept: rows.all.length - plan.length,
+                halfLives: new Map(plan.map((e) => [e.id, e.half_life_days]))
+            },
+        };
+    });
+    const moved = outcome ?? { rescaled: 0, typed: 0, kept: 0, halfLives: new Map() };
+    return { from, to, rescaled: moved.rescaled, typed: moved.typed, kept: moved.kept, dryRun, halfLives: moved.halfLives };
+}
+/** The base move and the move of object memories, planned from one read of the store. Pure. */
+function planMoves(rows, to) {
+    const { all, typedPending } = rows;
+    const objects = objectMemoryIds(rows.objectRows);
+    const losers = conflictLosers(rows.conflictAudits, rows.resolvedConflicts);
+    const copies = new Set(all.flatMap((e) => (e.superseded_by ? [e.superseded_by] : [])));
+    // Provenance before shape: an object's memory came from its writer, a supersede copy from the base (it keeps the source). Shape decides the rest.
+    const objectWritten = (e) => objects.all.has(e.id) || (!copies.has(e.id) && TYPED_SOURCES.has(e.source) && halfLifeRecallBonus(e, LEGACY_TYPED_HALF_LIFE) !== null);
+    const typedPlan = typedPending ? planTypedHalfLifeMigration(all.filter((e) => objectWritten(e) && !objects.retired.has(e.id) && !losers.has(e.id)), to) : [];
+    const basePlan = planHalfLifeMigration(typedPending ? all.filter((e) => !objectWritten(e)) : all, rows.from, to);
+    return { basePlan, typedPlan };
+}
+/** Memories behind every object, and those behind a superseded or closed one. Retiring an object leaves its memory untouched, so only its table knows. */
+function objectMemoryIds(objectRows) {
+    const all = new Set();
+    const retired = new Set();
+    for (const r of objectRows) {
+        all.add(r.memory_id);
+        if (r.status === 'superseded' || r.status === 'closed')
+            retired.add(r.memory_id);
+    }
+    return { all, retired };
+}
+/** Memories that lost a conflict, which resolveConflict halved untagged. A resolved conflict with no audit
+ * row (resolved before resolves were audited, or found stale) names no winner, so both sides count. */
+function conflictLosers(audited, resolved) {
+    const losers = new Set(audited.map((a) => a.loserId));
+    const named = new Set(audited.map((a) => a.conflictId));
+    for (const c of resolved)
+        if (!named.has(c.id))
+            losers.add(c.memory_a_id).add(c.memory_b_id);
+    return losers;
+}
+//# sourceMappingURL=half-life-migration.js.map

package/dist/consolidate/llm-passes.js

@@ -1,8 +1,8 @@
-import { envAnthropicApiKey, envDagRebuildCap } from '../env.js';
-import { Layer } from '../memory.js';
-import { log } from '../log.js';
+import { envAnthropicApiKey, envDagRebuildCap } from '../util/env.js';
+import { Layer } from '../core/memory.js';
+import { log } from '../util/log.js';
 import { keptAsWritten } from './run.js';
-import { isReusable } from '../memory-quality.js';
+import { isReusable } from '../core/memory-quality.js';
 /** The key, model options and once-per-line error reporter every LLM phase shares. */
 function sleepLlm(run, fetcher) {
     const { config, result } = run;
@@ -21,16 +21,14 @@ function sleepLlm(run, fetcher) {
     return { apiKey, llmError, llmOpts };
 }
 export async function llmPasses(run, fetcher) {
-    // -------------------------------------------------------------------------
     // 1.6. Batch extraction — extract facts from episodic memories missing them
-    // -------------------------------------------------------------------------
     const extractedFromIds = new Set(run.survivors.filter((e) => e.extracted_from).map((e) => e.extracted_from));
     const extractionCandidates = run.survivors.filter((e) => e.layer === Layer.Episodic && !e.superseded_by && !extractedFromIds.has(e.id) && !keptAsWritten(e)
         && e.trace_outcome === null && e.source !== 'auto-promote' && isReusable(e));
     run.result.extractionCandidates = extractionCandidates.length;
     const llm = sleepLlm(run, fetcher);
     if (llm.apiKey && extractionCandidates.length > 0 && !run.dryRun) {
-        const { extractFacts, storeExtractedFacts } = await import('../extract.js');
+        const { extractFacts, storeExtractedFacts } = await import('../learn/extract.js');
         const batchLimit = 20;
         let extractedCount = 0;
         for (const candidate of extractionCandidates.slice(0, batchLimit)) {
@@ -52,15 +50,13 @@ export async function llmPasses(run, fetcher) {
         await entityProfilePass(run, llm);
     }
 }
-// -------------------------------------------------------------------------
 // 1.7. DAG summarization — cluster extracted facts and generate summaries
-// -------------------------------------------------------------------------
 async function dagBuildPass(run, { apiKey, llmError, llmOpts }) {
     const extractedFacts = run.survivors.filter((e) => e.tags.includes('extracted') && e.dag_level === 1 && !e.superseded_by && isReusable(e));
     if (!(apiKey && extractedFacts.length >= 3 && !run.dryRun))
         return;
     try {
-        const { buildDag } = await import('../dag.js');
+        const { buildDag } = await import('./dag.js');
         const dagResult = await buildDag(run.hippoRoot, extractedFacts, { ...llmOpts, onError: llmError('dag') });
         run.result.dagCandidateClusters = dagResult.candidateClusters;
         run.result.dagSummariesCreated = dagResult.summariesCreated;
@@ -72,18 +68,12 @@ async function dagBuildPass(run, { apiKey, llmError, llmOpts }) {
         llmError('dag')(String(err));
     }
 }
-// -------------------------------------------------------------------------
-// 1.8. DAG summary rebuild — drain dirty queue from the child-write hooks
-// -------------------------------------------------------------------------
-// Consumer of the summary_dirty flag. Walks dirty L2 summaries, regenerates
-// each via generateDagSummary, atomically refreshes content + 6 metadata
-// columns + clears summary_dirty (with FTS sync). Same apiKey/dryRun gate
-// as buildDag above. Cap HIPPO_DAG_REBUILD_CAP (default 20, hard ceiling
-// 1000) prevents runaway LLM cost.
+// 1.8. DAG summary rebuild: drain the summary_dirty queue set by child-write hooks; same apiKey/dryRun gate as buildDag.
+// Cap HIPPO_DAG_REBUILD_CAP (default 20, hard ceiling 1000) prevents runaway LLM cost.
 async function dagRebuildPass(run, { llmError, llmOpts }) {
     const { result } = run;
     try {
-        const { rebuildDirtySummaries } = await import('../dag.js');
+        const { rebuildDirtySummaries } = await import('./dag.js');
         const rawCap = envDagRebuildCap();
         // Hard ceiling so a misconfigured env can't burn unbounded LLM cost.
         const cap = rawCap !== undefined ? Math.min(rawCap, 1000) : 20;
@@ -112,18 +102,11 @@ async function dagRebuildPass(run, { llmError, llmOpts }) {
         llmError('dag rebuild')(String(err));
     }
 }
-// -------------------------------------------------------------------------
-// 1.9. DAG entity profiles — cluster L2 topic summaries into L3 profiles
-// -------------------------------------------------------------------------
-// Aggregate per-entity L2 summaries (e.g. all the speaker:Alice
-// topic summaries) into a single L3 entity profile. Runs even when phase
-// 1.7 buildDag was skipped (re-clusters existing L2s every sleep).
-//
-// Uses loadAllL2Summaries (not `survivors`) because phase 1.7 wrote new
-// L2s directly via writeEntry without pushing back into survivors.
+// 1.9. DAG entity profiles: cluster L2 summaries into per-entity L3 profiles; runs even when 1.7 was skipped (re-clusters existing L2s every sleep).
+// Uses loadAllL2Summaries, not `survivors`: phase 1.7 wrote new L2s via writeEntry without pushing them into survivors.
 async function entityProfilePass(run, { llmError, llmOpts }) {
     try {
-        const { buildEntityProfiles } = await import('../dag.js');
+        const { buildEntityProfiles } = await import('./dag.js');
         const { loadAllL2Summaries } = await import('../store/summaries.js');
         const l2Summaries = loadAllL2Summaries(run.hippoRoot);
         if (l2Summaries.length >= 2) {

package/dist/consolidate/memory-value-weights.d.ts

@@ -0,0 +1,8 @@
+/** Frozen learned memory-value weight vector, GENERATED from benchmarks/memory-value/weights-learned.json; never edit by hand (a sync test fails CI on drift).
+ * CAVEAT: usage-feature signs come from an anti-oracle simulation, not real usage value; never read this as production ranking advice. */
+/** The 8 live feature dims the fitter optimized over (FIT_DIMS). */
+export declare const MEMORY_VALUE_WEIGHTS: Readonly<Record<string, number>>;
+/** sha256 of benchmarks/memory-value/weights-learned.json at freeze time
+ *  (weights-learned.meta.json's `weightsFileSha256`). */
+export declare const SOURCE_ARTIFACT_SHA256 = "1e747abed0df771fc9c354da8562771b336c4042faf0266f565bba1b5a8c5a40";
+//# sourceMappingURL=memory-value-weights.d.ts.map

package/dist/{memory-value-weights.js → consolidate/memory-value-weights.js}

@@ -1,16 +1,5 @@
-/**
- * Frozen learned memory-value weight vector.
- *
- * GENERATED FROM the frozen artifact
- * (benchmarks/memory-value/weights-learned.json +
- * benchmarks/memory-value/weights-learned.meta.json). NEVER EDIT BY HAND —
- * tests/memory-value-wiring.test.ts's weights-sync test asserts this constant
- * equals the committed JSON artifact (value equality + digest match), so
- * drift between the artifact and this file fails CI.
- *
- * CAVEAT: usage-feature signs reflect an anti-oracle simulation, NOT real usage
- * value. Never read this as production ranking advice.
- */
+/** Frozen learned memory-value weight vector, GENERATED from benchmarks/memory-value/weights-learned.json; never edit by hand (a sync test fails CI on drift).
+ * CAVEAT: usage-feature signs come from an anti-oracle simulation, not real usage value; never read this as production ranking advice. */
 /** The 8 live feature dims the fitter optimized over (FIT_DIMS). */
 export const MEMORY_VALUE_WEIGHTS = Object.freeze({
     age_days: -0.3245577821391783,

package/dist/consolidate/memory-value.d.ts

@@ -0,0 +1,45 @@
+/** Learned memory-value scorer, a rescue-only veto in the sleep decay pass (it can only shrink the condemned set); mirrors benchmarks/memory-value/*.mjs.
+ * rescueSet rescues a condemned entry iff it ranks in the top 30% (RESCUE_BUDGET) of its tenant's non-pinned set; memory-value-wiring.test.ts guards parity. */
+import { type MemoryEntry } from '../core/memory.js';
+/** The 8 live feature dims (FIT_DIMS) — canonical order for iteration. */
+export declare const MV_FEATURE_NAMES: ReadonlyArray<keyof MvFeatureVector>;
+export interface MvFeatureVector {
+    age_days: number;
+    half_life_days: number;
+    strength: number;
+    retrieval_count: number;
+    outcome_positive: number;
+    outcome_negative: number;
+    outcome_ratio: number;
+    content_length: number;
+}
+/** Blind v1 feature dict for one entry, restricted to the 8 dims the frozen weights carry. `strength` is CLOCK-BASIS `calculateStrength(entry, now)` with no
+ * DecayOptions, as in the weights' training; passing the production decay basis would silently break parity with the frozen weights. */
+export declare function computeMvFeatures(entry: MemoryEntry, now: Date): MvFeatureVector;
+export declare function validateWeights(weights?: Readonly<Record<string, number>>, digest?: string): void;
+/** Min-max normalize the 8 features over the given entries (constant -> 0), then score = dot(weights, normalized); callers set the scope.
+ * An entry with any non-finite feature (NaN from a malformed `created`) is excluded from normalization and scores -Infinity, so it can never be rescued. */
+export declare function scoreEntries(entries: MemoryEntry[], now: Date, weights?: Readonly<Record<string, number>>): Map<string, number>;
+/** Per-entry rank context within its tenant's non-pinned candidate set: the basis both rescueSet and the consolidate audit-row metadata read. */
+export interface MvRankInfo {
+    tenantId: string;
+    score: number;
+    /** 1-based rank by score DESC within the tenant's non-pinned candidate set. */
+    rank: number;
+    /** Size of the tenant's non-pinned candidate set. */
+    totalNonPinned: number;
+    /** ceil(RESCUE_BUDGET * totalNonPinned) — the rescue cutoff; rank <= keepN rescues. */
+    keepN: number;
+}
+/** Group non-pinned entries by tenantId, score and rank each group independently, and return rank context for every non-pinned entry;
+ * rescueSet and the consolidate audit rows share it so they never compute the ranking differently. */
+export declare function rankNonPinnedByTenant(entries: MemoryEntry[], now: Date, weights?: Readonly<Record<string, number>>, digest?: string): Map<string, MvRankInfo>;
+export interface RescueSetOptions {
+    readonly weights?: Readonly<Record<string, number>>;
+    readonly digest?: string;
+    readonly precomputedRanks?: Map<string, MvRankInfo>;
+}
+/** Rescue decision: the subset of condemnedIds ranking in the top 30% of their tenant's non-pinned set by learned score.
+ * Pass `precomputedRanks` to skip the internal ranking so the whole-store pass runs once per sleep; `weights`/`digest` overrides exist for tests only. */
+export declare function rescueSet(entries: MemoryEntry[], condemnedIds: Set<string>, now: Date, options?: RescueSetOptions): Set<string>;
+//# sourceMappingURL=memory-value.d.ts.map

package/dist/consolidate/memory-value.js

@@ -0,0 +1,164 @@
+/** Learned memory-value scorer, a rescue-only veto in the sleep decay pass (it can only shrink the condemned set); mirrors benchmarks/memory-value/*.mjs.
+ * rescueSet rescues a condemned entry iff it ranks in the top 30% (RESCUE_BUDGET) of its tenant's non-pinned set; memory-value-wiring.test.ts guards parity. */
+import { DEFAULT_TENANT_ID } from '../util/env.js';
+import { calculateStrength } from '../core/memory.js';
+import { compareEntryIdentity } from '../core/compare.js';
+import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
+import { DAY_MS } from '../util/time.js';
+/** The 8 live feature dims (FIT_DIMS) — canonical order for iteration. */
+export const MV_FEATURE_NAMES = [
+    'age_days',
+    'half_life_days',
+    'strength',
+    'retrieval_count',
+    'outcome_positive',
+    'outcome_negative',
+    'outcome_ratio',
+    'content_length',
+];
+/** The keep-budget operating point (the only point with measured
+ *  evidence): a code constant tied to that evidence, not user-tunable. */
+const RESCUE_BUDGET = 0.3;
+/** Per-tenant floor on the non-pinned candidate set: below it ranks are noise, and keepN=ceil(0.3*N) would rescue a 1-entry tenant's entry every sleep forever.
+ * A code constant tied to that reasoning, not user-tunable (like RESCUE_BUDGET). */
+const MIN_RESCUE_GROUP = 10;
+/** Blind v1 feature dict for one entry, restricted to the 8 dims the frozen weights carry. `strength` is CLOCK-BASIS `calculateStrength(entry, now)` with no
+ * DecayOptions, as in the weights' training; passing the production decay basis would silently break parity with the frozen weights. */
+export function computeMvFeatures(entry, now) {
+    const ageDays = (now.getTime() - Date.parse(entry.created)) / DAY_MS;
+    const pos = entry.outcome_positive ?? 0;
+    const neg = entry.outcome_negative ?? 0;
+    return {
+        age_days: ageDays,
+        half_life_days: entry.half_life_days,
+        strength: calculateStrength(entry, now), // clock-basis, never decayOpts — see doc comment above
+        retrieval_count: entry.retrieval_count,
+        outcome_positive: pos,
+        outcome_negative: neg,
+        outcome_ratio: (pos - neg) / (pos + neg + 1), // same formula as extract.mjs / calculateRewardFactor's ratio term
+        content_length: entry.content.length,
+    };
+}
+/** Throws on a malformed weight constant (wrong dims, non-finite weight, missing digest): flag-on with a broken constant must throw, never act as flag-off.
+ * Parameterized (default: the frozen singleton) so the throw paths are unit-testable. */
+function isFiniteWeightValue(value) {
+    return typeof value === 'number' && Number.isFinite(value);
+}
+function isNonEmptyDigestString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+export function validateWeights(weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256) {
+    for (const key of MV_FEATURE_NAMES) {
+        const v = weights[key];
+        if (!isFiniteWeightValue(v)) {
+            throw new Error(`memory-value: weights constant is malformed — "${key}" is not a finite number ` +
+                `(src/consolidate/memory-value-weights.ts)`);
+        }
+    }
+    if (!isNonEmptyDigestString(digest)) {
+        throw new Error('memory-value: weights constant is malformed — SOURCE_ARTIFACT_SHA256 digest missing (src/consolidate/memory-value-weights.ts)');
+    }
+}
+/** Min-max normalize the 8 features over the given entries (constant -> 0), then score = dot(weights, normalized); callers set the scope.
+ * An entry with any non-finite feature (NaN from a malformed `created`) is excluded from normalization and scores -Infinity, so it can never be rescued. */
+export function scoreEntries(entries, now, weights = MEMORY_VALUE_WEIGHTS) {
+    const raw = new Map();
+    for (const e of entries)
+        raw.set(e.id, computeMvFeatures(e, now));
+    const nonFiniteIds = new Set();
+    for (const e of entries) {
+        const nf = raw.get(e.id);
+        if (MV_FEATURE_NAMES.some((f) => !Number.isFinite(nf[f])))
+            nonFiniteIds.add(e.id);
+    }
+    const normContextEntries = entries.filter((e) => !nonFiniteIds.has(e.id));
+    const minMax = new Map();
+    for (const f of MV_FEATURE_NAMES) {
+        let min = Infinity;
+        let max = -Infinity;
+        for (const e of normContextEntries) {
+            const v = raw.get(e.id)[f];
+            if (v < min)
+                min = v;
+            if (v > max)
+                max = v;
+        }
+        minMax.set(f, { min, max });
+    }
+    const norm = (f, v) => {
+        const { min, max } = minMax.get(f);
+        return max === min ? 0 : (v - min) / (max - min);
+    };
+    const scores = new Map();
+    for (const e of entries) {
+        if (nonFiniteIds.has(e.id)) {
+            scores.set(e.id, -Infinity);
+            continue;
+        }
+        const nf = raw.get(e.id);
+        let sum = 0;
+        for (const f of MV_FEATURE_NAMES)
+            sum += weights[f] * norm(f, nf[f]);
+        scores.set(e.id, sum);
+    }
+    return scores;
+}
+/** Group non-pinned entries by tenantId, score and rank each group independently, and return rank context for every non-pinned entry;
+ * rescueSet and the consolidate audit rows share it so they never compute the ranking differently. */
+export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256) {
+    validateWeights(weights, digest);
+    const byTenant = new Map();
+    for (const e of entries) {
+        if (e.pinned)
+            continue; // pinned entries never compete for rescue (never condemned)
+        // Default an undefined tenantId as dag.ts:341 does: a raw/legacy row can carry one at runtime,
+        // and keying it "undefined" would split it into its own singleton tenant.
+        const tenantId = e.tenantId ?? DEFAULT_TENANT_ID;
+        const list = byTenant.get(tenantId);
+        if (list)
+            list.push(e);
+        else
+            byTenant.set(tenantId, [e]);
+    }
+    const result = new Map();
+    for (const [tenantId, group] of byTenant) {
+        const scores = scoreEntries(group, now, weights);
+        // score DESC, then compareEntryIdentity, the shared tie-break of every score-primary sort (src/core/compare.ts).
+        // `-Infinity - -Infinity` is NaN, which Array.sort leaves insertion-order-dependent, so NaN ties too.
+        const sorted = [...group].sort((a, b) => {
+            const diff = scores.get(b.id) - scores.get(a.id);
+            return diff === 0 || Number.isNaN(diff) ? compareEntryIdentity(a, b) : diff;
+        });
+        // Tenants smaller than MIN_RESCUE_GROUP never rescue (keepN 0); see that constant's doc comment.
+        const keepN = sorted.length < MIN_RESCUE_GROUP
+            ? 0
+            : Math.min(sorted.length, Math.ceil(RESCUE_BUDGET * sorted.length));
+        sorted.forEach((e, i) => {
+            result.set(e.id, {
+                tenantId,
+                score: scores.get(e.id),
+                rank: i + 1,
+                totalNonPinned: sorted.length,
+                keepN,
+            });
+        });
+    }
+    return result;
+}
+/** Rescue decision: the subset of condemnedIds ranking in the top 30% of their tenant's non-pinned set by learned score.
+ * Pass `precomputedRanks` to skip the internal ranking so the whole-store pass runs once per sleep; `weights`/`digest` overrides exist for tests only. */
+export function rescueSet(entries, condemnedIds, now, options = {}) {
+    const { weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256, precomputedRanks } = options;
+    validateWeights(weights, digest); // fail loud before any rescue computation
+    const ranked = precomputedRanks ?? rankNonPinnedByTenant(entries, now, weights, digest);
+    const rescued = new Set();
+    for (const id of condemnedIds) {
+        const info = ranked.get(id);
+        // An explicit finite guard, not just -Infinity sorting last: when a whole tenant
+        // ties at -Infinity, rank alone could place one inside keepN.
+        if (info && info.rank <= info.keepN && Number.isFinite(info.score))
+            rescued.add(id);
+    }
+    return rescued;
+}
+//# sourceMappingURL=memory-value.js.map

package/dist/consolidate/merge.js

@@ -1,32 +1,26 @@
-import { Layer, calculateStrength, createMemory } from '../memory.js';
-import { tokenize } from '../tokenize.js';
-import { jaccardMinShared, overlapPartners } from '../overlap-index.js';
-import { compareEntryIdentity } from '../compare.js';
-import { duplicateKey, mergedText } from '../same-text.js';
-import { successorAfterRetirement } from '../merged-row.js';
-import { rejectionDigest, findRejectedValue } from '../rejection.js';
-import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { derivationScope, derivationPartitionKey } from '../recall-scope.js';
+import { Layer, calculateStrength, createMemory } from '../core/memory.js';
+import { tokenize } from '../util/tokenize.js';
+import { jaccardMinShared, overlapPartners } from './overlap-index.js';
+import { compareEntryIdentity } from '../core/compare.js';
+import { duplicateKey, mergedText } from '../util/same-text.js';
+import { successorAfterRetirement } from './merged-row.js';
+import { rejectionDigest } from '../store/rejection.js';
+import { reportAuditWriteFailure } from '../store/audit.js';
+import { derivationScope, derivationPartitionKey } from '../store/recall-scope.js';
 import { jaccardSets } from './conflicts.js';
 import { keptAsWritten } from './run.js';
-import { isReusable } from '../memory-quality.js';
+import { isReusable } from '../core/memory-quality.js';
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
 const MERGE_MAX_SOURCES = 5; // with MERGE_MAX_CHARS, keeps a merged row near 500 tokens, a third of the 1,500-token context budget
 const MERGE_MAX_CHARS = 2000; // total source text; sources past either cap stay unmerged and keep their half-life
-// Half-life scale for merged source episodics. Demotion must go through
-// half_life_days: calculateStrength() recomputes live strength from
-// last_retrieved/half_life and never reads the stored strength field, so a
-// stored-strength write is inert for ranking and gets overwritten by the
-// next sleep's decay pass anyway.
+// Half-life scale for merged source episodics. Demote via half_life_days: calculateStrength() recomputes live strength and never reads the stored field,
+// so a stored-strength write is inert for ranking and overwritten by the next decay pass.
 const MERGE_SOURCE_HALF_LIFE_FACTOR = 0.3;
 export function retireHeldTexts(run) {
     const { survivors } = run;
     const byId = new Map(run.all.map((e) => [e.id, e]));
-    const rejectedIn = (tenantId) => (text) => {
-        const db = run.getConsolidateDb();
-        return db !== null && findRejectedValue(db, tenantId, rejectionDigest(text)) !== null;
-    };
+    const rejectedIn = (tenantId) => (text) => run.tombstones.find(tenantId, rejectionDigest(text)) !== null;
     for (let i = survivors.length - 1; i >= 0; i--) {
         const row = survivors[i];
         const successor = run.retirable(row) ? successorAfterRetirement(row, byId, rejectedIn(row.tenantId)) : undefined;
@@ -46,17 +40,13 @@ export function retireHeldTexts(run) {
         }
     }
 }
-// -------------------------------------------------------------------------
-// 3. Merge pass  - episodic entries only
-// -------------------------------------------------------------------------
-/** Returns how many clusters were skipped because their merged text matches a rejected value. */
-export function mergePass(run) {
-    const alreadyMergedIds = new Set(run.survivors.flatMap((e) => e.parents));
-    const mergeCandidates = run.survivors.filter((e) => e.layer === Layer.Episodic && !e.superseded_by && !keptAsWritten(e) && !alreadyMergedIds.has(e.id)
+/** The episodic survivors a merge may consume, grouped by the partition their merged row would land in. */
+function partitionMergeCandidates(survivors) {
+    const alreadyMergedIds = new Set(survivors.flatMap((e) => e.parents));
+    const mergeCandidates = survivors.filter((e) => e.layer === Layer.Episodic && !e.superseded_by && !keptAsWritten(e) && !alreadyMergedIds.has(e.id)
         && !e.pinned // a pin merged with a look-alike would read as one of two values
         && tokenize(e.content).length > 0 // two empty token sets overlap 1, so tokenless text would merge with any other
         && isReusable(e));
-    const used = new Set();
     // Partition BEFORE the overlap loop so a cluster can never span tenants and merge cross-tenant content.
     // Map keeps insertion order, so a single-tenant store gets one partition in the original order.
     const mergeCandidatesByTenant = new Map();
@@ -68,7 +58,14 @@ export function mergePass(run) {
         else
             mergeCandidatesByTenant.set(key, [entry]);
     }
-    // The rejection guard reuses the one consolidateDb handle opened lazily in consolidate(); a dry-run
+    return mergeCandidatesByTenant;
+}
+// 3. Merge pass  - episodic entries only
+/** Returns how many clusters were skipped because their merged text matches a rejected value. */
+export function mergePass(run) {
+    const used = new Set();
+    const mergeCandidatesByTenant = partitionMergeCandidates(run.survivors);
+    // The rejection guard reuses the run's one lazily opened tombstone handle; a dry-run
     // never reaches batchWriteAndDelete's guard bypass, so it has nothing to protect there.
     let mergesSkippedRejected = 0;
     for (const [, tenantCandidates] of mergeCandidatesByTenant) {
@@ -107,28 +104,9 @@ function mergeCluster(run, partition, cluster, related, used) {
     const { result, dryRun } = run;
     // Create a semantic summary
     const mergedContent = mergeContents(cluster);
-    const allTags = Array.from(new Set(cluster.flatMap((e) => e.tags))).sort();
-    const maxValence = pickStrongestValence(cluster);
     // Build the semantic entry FIRST (createMemory is cheap and pure) so the tombstone check below runs
     // under the partition's tenant, the one every cluster member shares and the row will land in.
-    let semantic = null;
-    if (!dryRun) {
-        semantic = {
-            ...createMemory(mergedContent, {
-                layer: Layer.Semantic,
-                tags: allTags,
-                emotional_valence: maxValence,
-                schema_fit: 0.7,
-                source: 'consolidation',
-                confidence: 'inferred',
-                tenantId: partition.tenantId,
-                scope: partition.scope,
-                baseHalfLifeDays: run.config.defaultHalfLifeDays,
-            }),
-            origin_project: partition.origin,
-            parents: cluster.map((e) => e.id),
-        };
-    }
+    const semantic = dryRun ? null : semanticSummary(mergedContent, cluster, partition, run.config.defaultHalfLifeDays);
     if (semantic && mergeRejected(run, semantic, cluster, related, used))
         return false;
     // Mark cluster members as used
@@ -140,51 +118,55 @@ function mergeCluster(run, partition, cluster, related, used) {
         run.pendingWrites.push(semantic);
         run.units.push([semantic.id, ...cluster.map((e) => e.id)]);
         result.semanticCreated++;
-        // Demote source episodics (they've been compressed into neocortex):
-        // scale half_life_days so they decay sooner while staying recoverable.
-        // Immediate ranking is deliberately unchanged: dropping children below a
-        // worse-retrieving summary regresses budget-bounded QA. The stored
-        // strength is refreshed to the live value so inspect, replay sampling,
-        // and strength-sorted assembly see the truth instead of a fake 0.3.
-        // Mutate in place (not a copy): `cluster` holds the same object
-        // references as `survivors`, and the later detectConflicts(survivors)
-        // pass in this same run must see the post-demotion half-life, or it
-        // can persist conflicts for entries the just-written state excludes.
-        for (const e of cluster) {
-            e.half_life_days = Math.max(1, Math.floor(e.half_life_days * MERGE_SOURCE_HALF_LIFE_FACTOR));
-            e.strength = calculateStrength(e, run.now, run.decayOpts);
-            run.pendingWrites.push(e);
-        }
+        // Scale half_life_days so merged sources decay sooner but stay recoverable; ranking is unchanged on purpose (demoting children regresses QA).
+        // Mutate in place: `cluster` shares references with `survivors`, and the later detectConflicts(survivors) must see the post-demotion half-life.
+        demoteMergedSources(run, cluster);
     }
     return true;
 }
-// mergeContents is DETERMINISTIC CONCATENATION (not an LLM paraphrase)
-// — if a human rejected exactly this byte-identical rollup before, an
-// unguarded sleep would regenerate it every cycle and
-// batchWriteAndDelete's guard bypass (store.ts) would silently
-// re-assert it forever. This producer-side check is what makes that
-// bypass safe. A hit skips the WHOLE cluster: sources stay unmerged —
-// not demoted, not deleted — so a later sleep gets another chance if
-// the tombstone is lifted.
+function semanticSummary(mergedContent, cluster, partition, baseHalfLifeDays) {
+    const allTags = Array.from(new Set(cluster.flatMap((e) => e.tags))).sort();
+    const maxValence = pickStrongestValence(cluster);
+    return {
+        ...createMemory(mergedContent, {
+            layer: Layer.Semantic,
+            tags: allTags,
+            emotional_valence: maxValence,
+            schema_fit: 0.7,
+            source: 'consolidation',
+            confidence: 'inferred',
+            tenantId: partition.tenantId,
+            scope: partition.scope,
+            baseHalfLifeDays,
+        }),
+        origin_project: partition.origin,
+        parents: cluster.map((e) => e.id),
+    };
+}
+function demoteMergedSources(run, cluster) {
+    for (const e of cluster) {
+        e.half_life_days = Math.max(1, Math.floor(e.half_life_days * MERGE_SOURCE_HALF_LIFE_FACTOR));
+        e.strength = calculateStrength(e, run.now, run.decayOpts);
+        run.pendingWrites.push(e);
+    }
+}
+// mergeContents is deterministic, so a rollup a human already rejected would regenerate each cycle and batchWriteAndDelete's guard bypass would re-assert it;
+// this producer-side check makes that bypass safe. A hit skips the whole cluster (no demote, no delete) so a later sleep can retry.
 function mergeRejected(run, semantic, cluster, related, used) {
-    const consolidateDb = run.getConsolidateDb();
-    if (!consolidateDb)
-        return false;
+    const { tombstones } = run;
     const newDigest = rejectionDigest(semantic.content);
     const oldDigest = rejectionDigest(legacyMergeContents(related)); // tombstones from older releases hold this format's digest
-    const newHit = findRejectedValue(consolidateDb, semantic.tenantId, newDigest);
-    const tombstone = newHit ?? findRejectedValue(consolidateDb, semantic.tenantId, oldDigest);
+    const newHit = tombstones.find(semantic.tenantId, newDigest);
+    const tombstone = newHit ?? tombstones.find(semantic.tenantId, oldDigest);
     const mergeDigest = newHit ? newDigest : oldDigest;
     if (!tombstone)
         return false;
-    // Still mark used — these members are not re-tried against a
-    // DIFFERENT cluster within this same pass; next sleep re-clusters
-    // them fresh.
+    // Still mark used: these members are not re-tried against a different cluster in this pass; the next sleep re-clusters them fresh.
     const rejected = newHit ? cluster : related; // the old format digested the uncapped list, so rows past the cap were rejected too
     for (const e of rejected)
         used.add(e.id);
     try {
-        appendAuditEvent(consolidateDb, {
+        tombstones.audit({
             tenantId: semantic.tenantId,
             actor: 'sleep',
             op: 'reject_refusal',
@@ -200,9 +182,7 @@ function mergeRejected(run, semantic, cluster, related, used) {
     }
     return true;
 }
-// ---------------------------------------------------------------------------
 // Helpers
-// ---------------------------------------------------------------------------
 function mergeContents(entries) {
     // Each distinct text goes in once and in full (the merge demotes every source), one bullet with its lines indented, so heldTextKeys can read it back.
     // Newest first says which version is current; compareEntryIdentity settles ties, so the row and its rejection digest depend only on the sources.
@@ -212,7 +192,9 @@ function mergeContents(entries) {
         if (!texts.has(duplicateKey(e.content)))
             texts.set(duplicateKey(e.content), e.content);
     }
-    const header = entries.length === 2 ? '[Consolidated from 2 related memories, newest first]' : `[Consolidated pattern from ${entries.length} related memories, newest first]`;
+    const header = entries.length === 2
+        ? '[Consolidated from 2 related memories, newest first]'
+        : `[Consolidated pattern from ${entries.length} related memories, newest first]`;
     return mergedText(header, [...texts.values()]);
 }
 function legacyMergeContents(entries) {