memhtml 0.7.0 → 0.7.2

package/dist/{dist-D1wH0oJ0.mjs → dist-xlKgJuWn.mjs}

@@ -4346,6 +4346,18 @@ const parseLsTree = (output) => output.split("\0").filter((row) => row !== "").f
 		path: row.slice(tab + 1)
 	}];
 });
+/**
+* A bare NUL-terminated path list, which is what every `-z` path-only git output is.
+*
+* One function for the shape rather than one `split` per call site, because the trailing NUL is what
+* makes the naive read wrong: `"a\0b\0"` splits into three fields, the last empty, so a caller that
+* forgets the filter gets an empty string in its path set. `diff-tree --name-only -z` and
+* `diff --name-only --diff-filter=U -z` are both this shape.
+*
+* `-z` is also what removes the escaping question: under newline framing git applies `core.quotePath`
+* and a path holding a non-ASCII byte arrives as `"caf\303\251.html"`, quotes included.
+*/
+const parseNulPathList = (output) => output.split("\0").filter((path) => path !== "");
 /** The status letters git emits, mapped to the names this package uses. */
 const CHANGE_KINDS = {
 	A: "added",
@@ -4639,10 +4651,15 @@ var GitFailure = class extends Schema.TaggedError()("GitFailure", {
 }) {};
 const Git = Context.Service("memhtml/Git");
 /**
-* Environment for every git call. The three `GIT_CONFIG_*` variables suppress any
-* `~/.gitconfig` alias, hook path, or template dir that would otherwise change what these
-* commands do on a developer's machine but not in CI. `GIT_TERMINAL_PROMPT=0` is what keeps a
-* credential prompt from hanging a headless indexer forever.
+* Environment for every git call. `GIT_TERMINAL_PROMPT=0` keeps a credential prompt from hanging a
+* headless indexer forever, `GIT_OPTIONAL_LOCKS=0` stops a read from taking the index lock, and
+* `LC_ALL=C` pins the message locale so a parsed word is the same word everywhere.
+*
+* **A user's own config IS read.** Nothing here neutralizes `~/.gitconfig`, so every call whose output
+* a caller parses states its format with explicit flags rather than inheriting a default: `-z` against
+* `core.quotePath`, `-M` and `--no-renames` against `diff.renames`, `--porcelain=v2` against every
+* status shorthand. A format a developer's machine and CI could disagree about is a format this
+* service does not rely on.
 */
 const GIT_ENV = {
 	GIT_TERMINAL_PROMPT: "0",
@@ -4651,6 +4668,8 @@ const GIT_ENV = {
 };
 /** 64 MiB. A `cat-file --batch` over a whole corpus is the one call with a large stdout. */
 const MAX_BUFFER = 67108864;
+/** A full 40-hex object name, which is the only form {@link GitShape.diffTreeNames} accepts. */
+const FULL_OBJECT_NAME = /^[0-9a-f]{40}$/;
 /**
 * Spawn git and collect its output as bytes.
 *
@@ -4735,6 +4754,50 @@ const makeGit = (root) => ({
 		from,
 		to
 	]).pipe(Effect.map((result) => parseDiffNameStatus(text$1(result)))),
+	/**
+	* Dropping any of the first five flags makes the answer SILENTLY smaller or dirtier rather than an
+	* error, which is why each has its own case in `git.test.ts`. Measured against git 2.50.1 on
+	* 2026-08-26:
+	*
+	* - `--stdin`, so a range of hundreds of commits costs one process;
+	* - `-r`, or the answer is the changed TREE (`areas`) instead of the blobs under it;
+	* - `-m`, or a merge commit reports ZERO paths (empty without, its paths with, and byte-identical
+	*   on a single-parent commit, so it is free);
+	* - `--root`, or a root commit reports ZERO paths (0 without, its whole tree with);
+	* - `--no-commit-id`, or each commit's own 40-hex sha arrives as a line among the paths;
+	* - `-z`, which frames on NUL and disables `core.quotePath` — under newline framing a path
+	*   holding a non-ASCII byte arrives as `"areas/x/caf\303\251.html"`, quoted and escaped, and
+	*   equals nothing a caller compares it to.
+	*
+	* `--no-renames` is INERT here and is declared anyway. `diff-tree` detects no renames in this form
+	* whatever the config says — probed under `diff.renames` unset, `true`, and `copies`, all three
+	* reporting both paths of a `git mv` — so the flag pins that default rather than producing it, the
+	* same reason the calls above spell `-z` and `--porcelain=v2`. What holds the behavior is the test,
+	* not the flag: a caller unioning paths needs the path that went away as much as the one that
+	* arrived, and `git diff --name-only` (which DOES detect renames) reports only the destination.
+	*
+	* **An abbreviated sha is refused rather than passed through**, because git echoes the short name
+	* as its own output line and reports no diff at all — with `--no-commit-id` set, a caller would
+	* receive one bogus path and no real ones, at exit 0. `%H` from `logTrailers` is already full, so
+	* the check costs nothing and closes the one input that fails quietly.
+	*/
+	diffTreeNames: (commits) => {
+		if (commits.find((sha) => !FULL_OBJECT_NAME.test(sha)) !== void 0) return Effect.fail(GitFailure.make({
+			command: "diff-tree",
+			exitCode: null
+		}));
+		return commits.length === 0 ? Effect.succeed([]) : git(root, "diff-tree", [
+			"diff-tree",
+			"-r",
+			"-m",
+			"--root",
+			"--stdin",
+			"--no-commit-id",
+			"--name-only",
+			"-z",
+			"--no-renames"
+		], { stdin: `${commits.join("\n")}\n` }).pipe(Effect.map((result) => parseNulPathList(text$1(result))));
+	},
 	statusPorcelainV2: () => git(root, "status", [
 		"status",
 		"--porcelain=v2",
@@ -4811,7 +4874,7 @@ const makeGit = (root) => ({
 		]);
 		return {
 			merged: false,
-			conflicted: text$1(unmerged).split("\0").filter((path) => path !== "")
+			conflicted: parseNulPathList(text$1(unmerged))
 		};
 	}),
 	mergeAbort: () => git(root, "merge-abort", ["merge", "--abort"]).pipe(Effect.asVoid),
@@ -10009,6 +10072,47 @@ const TRAILER_RUN = "Memhtml-Run";
 const TRAILER_PHASE = "Memhtml-Phase";
 const TRAILER_COUNTS = "Memhtml-Counts";
 /**
+* Phases whose commit is a UNIFORM SWEEP: one head stamp applied to every eligible file by a rule,
+* carrying no per-file decision and authoring no edge.
+*
+* This is the distinction `placement-triage`'s this-run guard turns on. That guard refuses to move a
+* file another phase wrote on this branch, because a move would fold that phase's edit into a rename
+* a reviewer reads somewhere else. A sweep has no edit to fold: `confidence-decay` restamps
+* `memhtml-confidence` and `memhtml-updated` on every eligible active file, and its value is a
+* mechanical function of the value already in the file (`decayConfidence`), so nothing about it is
+* invalidated by the file being at a different path afterwards. It is also the WIDEST commit in a
+* run, so a guard that counts it pins essentially the whole corpus and the phase downstream refuses
+* essentially everything (issue #81).
+*
+* **The list enumerates the sweeps, so a phase absent from it PINS.** The two mistakes cost
+* different amounts. A phase wrongly treated as a sweep lets placement move a file it just wrote —
+* a committed href that dangles, or a decision folded into a rename — while a phase wrongly pinning
+* costs one night's yield on a file that is still a candidate tomorrow. So membership is an explicit
+* claim and the default is the recoverable side.
+*
+* A phase that calls a model is never a member: a model answer is a per-file decision. The two lists
+* are asserted disjoint in `units.test.ts`.
+*
+* The near-misses, because the absences carry the rule:
+*
+* - `reprieve` writes only head metas too, and is still out. `memhtml-valid-until` plus
+*   `memhtml-reprieves` IS a per-file retention decision, and a reviewer reads it at the path it was
+*   decided on. Its volume is bounded to the files whose TTL passed, so membership would buy almost
+*   no reach against that.
+* - `person-links` and `edge-typing` splice `<link>` elements, which leave the article's bytes — and
+*   therefore its content hash — identical. So the meaning of a change, not its width, is what
+*   decides membership: a hash-based rule would release exactly these two, and placement's inbound
+*   href rewrite reads the INDEX, which no phase refreshes mid-run, so an edge authored this run is
+*   invisible to it and the move would leave the href dangling.
+* - `preflight` and `relationship-mining` are in {@link NON_COMMITTING_PHASES}, so no commit of
+*   theirs can appear in a range; `integrity`, `state-export`, and `report` run after
+*   `placement-triage`, so theirs cannot either. Membership for any of the five would be a claim
+*   nothing can exercise.
+*/
+const SWEEP_PHASES = ["confidence-decay"];
+/** True when a phase's commit is a uniform sweep. See {@link SWEEP_PHASES}. */
+const isSweepPhase = (phase) => SWEEP_PHASES.includes(phase);
+/**
 * Where a run's ledger lives: beside its report, under the same run-id-to-filename rule.
 *
 * `/` is not legal in a filename and a run id is `sleep/<date>`, so the separator becomes a hyphen —
@@ -15743,6 +15847,84 @@ const personLinks = (env) => Effect.gen(function* () {
 	};
 });
 
+//#endregion
+//#region packages/sleep/dist/touched.js
+/**
+* True when a commit's `Memhtml-Phase` trailer says every phase that made it is a sweep.
+*
+* **A missing, empty, or unrecognized value pins.** The trailer is what identifies a sweep, so the
+* absence of the identification cannot grant the exemption — an operator's own mid-run commit, a
+* commit stamped with a phase name this version does not know, and a forged value that is not a phase
+* all land on the conservative side. `every` rather than `some` for the same reason: a commit
+* claiming two phases is exempt only if neither of them decided anything.
+*/
+const isSweepCommit = (values) => values.length > 0 && values.every((value) => isSleepPhase(value) && isSweepPhase(value));
+/**
+* The paths this run wrote, excluding the sweeps.
+*
+* **Paths come back exactly as git spells them, with no normalization, and that is deliberate.**
+* `diff-tree --name-only -z` emits repo-root-relative, `/`-separated, unquoted paths with no leading
+* slash — the same spelling the `files` table holds, because the indexer derived those from
+* `git ls-tree`. `normalizePath` strips leading slashes, collapses doubled ones, and trims a trailing
+* one, so against this output it is a no-op, and a no-op called for its name reads as a guarantee
+* nobody checks. What holds the two spellings in agreement is a test that moves a real file after a
+* real phase wrote it.
+*
+* The set legitimately holds paths that are not memories — `edge-typing` stages its pending-marks
+* ledger into its own commit — and they are inert, because a caller only ever asks whether a
+* candidate's own path is in it.
+*
+* `baseSha === ""` is an empty set rather than a scan of all of `HEAD`. Over `HEAD` a previously
+* merged run's trailers name every phase, so the set would become every file every past sleep ever
+* touched: the same over-pinning, one release further back. With no base there is no run to bound, and
+* production always has one because `preflight` requires a commit and a clean tree.
+*/
+const touchedThisRun = (git, baseSha) => Effect.gen(function* () {
+	if (baseSha === "") return {
+		kind: "scoped",
+		paths: /* @__PURE__ */ new Set(),
+		commits: 0,
+		sweeps: 0
+	};
+	const range = `${baseSha}..HEAD`;
+	const read = yield* Effect.result(git.logTrailers(range, TRAILER_PHASE));
+	if (Result.isFailure(read)) {
+		yield* Effect.logWarning(`sleep.touched could not read ${TRAILER_PHASE} over ${range}; pinning the whole range`);
+		return yield* widen(git, baseSha);
+	}
+	const records = read.success;
+	const semantic = records.flatMap((record) => isSweepCommit(record.values) ? [] : [record.sha]);
+	const diffed = yield* Effect.result(git.diffTreeNames(semantic));
+	if (Result.isFailure(diffed)) {
+		yield* Effect.logWarning(`sleep.touched could not diff ${String(semantic.length)} commit(s) of ${range}; pinning the whole range`);
+		return yield* widen(git, baseSha);
+	}
+	return {
+		kind: "scoped",
+		paths: new Set(diffed.success),
+		commits: semantic.length,
+		sweeps: records.length - semantic.length
+	};
+});
+/**
+* Every path the range touched, as the fallback when the scoped read could not be made.
+*
+* Through `diffNameStatus`, which detects renames and reports the pre-move path in `fromPath`. BOTH
+* sides go in: this set exists to be conservative, and a `git mv`'s source is a path a phase wrote as
+* surely as its destination is.
+*/
+const widen = (git, baseSha) => git.diffNameStatus(baseSha, "HEAD").pipe(Effect.map((changes) => {
+	const paths = /* @__PURE__ */ new Set();
+	for (const change of changes) {
+		paths.add(change.path);
+		if (change.fromPath !== null) paths.add(change.fromPath);
+	}
+	return {
+		kind: "widened",
+		paths
+	};
+}), Effect.orElseSucceed(() => ({ kind: "unknown" })));
+
 //#endregion
 //#region packages/sleep/dist/phases/placement-triage.js
 /**
@@ -15768,12 +15950,22 @@ const personLinks = (env) => Effect.gen(function* () {
 *   `archive/`, and any path outside the PARA buckets;
 * - tasks never move (excluded from the scan AND re-checked per row, matching the double guard
 *   task-detection carries);
-* - a file another phase already touched this run never moves, read from `git diff --name-only
-*   base..HEAD` — a `mv` of a path compress just archived would fail, and one of a path an earlier
-*   phase stamped would tear that phase's edit out of its own commit's diff;
+* - a file a phase whose write carries a DECISION already touched this run never moves, read from
+*   the diffs of the run's own commits whose `Memhtml-Phase` trailer is not in `SWEEP_PHASES` — a
+*   `mv` of a path compress just archived would fail, and one of a path a phase stamped a link into
+*   would tear that phase's edit out of the commit a reviewer reads it in. A SWEEP is exempt:
+*   `confidence-decay` restamps every eligible file in the corpus by a rule, so counting it pins
+*   essentially every candidate and this phase refuses essentially everything (issue #81). An
+*   unreadable trailer or diff widens the set to the whole range instead of emptying it, and a
+*   set that cannot be read at all returns before a single model call;
 * - `keep-inbox`, an unknown key, a below-floor confidence, and an omitted member all leave the
 *   file where it is.
 *
+* **Every refusal is its own count**, one key per class beside the `refused` total
+* ({@link PLACEMENT_REFUSALS}). Nine classes pooled into one number make a night where the phase
+* applied nothing unreadable without a log grep, which is exactly how issue #81's mechanism stayed
+* hidden for two runs.
+*
 * **Inbound hrefs are rewritten in the same commit.** Integrity's dangling-href repair chases a
 * target into the ARCHIVE by deriving `archivePathFor`; a placement move is not an archive, so this
 * phase rewrites `<link>` elements in the files that point at each moved path itself, the same
@@ -15792,6 +15984,30 @@ const PLACEMENT_MEMBER_CHARS = 600;
 * thirty new topics should earn them over several reviewed runs, not one.
 */
 const PLACEMENT_NEW_DIR_CAP = 5;
+/**
+* Every refusal class, as its count key and the prose it logs. The keys ARE the partition of
+* `refused`, which stays the total.
+*
+* One map rather than a prose string per guard, so the count and the log line cannot name different
+* things and a class cannot exist without a count. `refused` keeps its meaning exactly — an existing
+* reader is unaffected — and every case in `deep.test.ts`'s guard g asserts the parts sum to it.
+*
+* `refusedTouched` and `refusedAlreadyMoved` are separate because they are separate facts: the first
+* is another phase's write, the second is THIS phase having already moved the file in an earlier row
+* of the same run. One key covering both would report a duplicate model answer as cross-phase
+* contamination, and an operator reading the count would go looking for a phase that wrote nothing.
+*/
+const PLACEMENT_REFUSALS = {
+	refusedLowConfidence: "below the confidence floor",
+	refusedDestination: "not a placeable directory",
+	refusedTask: "tasks never move",
+	refusedTouched: "a phase that decides wrote this file this run",
+	refusedAlreadyMoved: "this run already moved this file",
+	refusedNewDirCap: "the new-directory cap for this run is spent",
+	refusedInvalidPath: "the destination path is not a valid memory path",
+	refusedCollision: "the destination already holds a file by that name",
+	refusedSourceGone: "the source file is already gone from the tree"
+};
 const placementTriage = (env) => Effect.gen(function* () {
 	if (env.deep === void 0) return {
 		...emptyOutcome({ candidates: 0 }),
@@ -15828,12 +16044,12 @@ const placementTriage = (env) => Effect.gen(function* () {
 		PEOPLE_DIR
 	]);
 	const existingDirs = [...new Set(corpus.map((row) => row.path.slice(0, row.path.lastIndexOf("/"))).filter((dir) => (dir.startsWith("areas/") || dir.startsWith("resources/")) && !managed.has(dir)))].sort();
-	/** Paths this run already touched. A move of one would cross-contaminate another phase's diff. */
-	const touched = new Set(env.baseSha === "" ? [] : yield* env.deps.git.run([
-		"diff",
-		"--name-only",
-		`${env.baseSha}..HEAD`
-	]).pipe(Effect.map((out) => out.split("\n").map((line) => line.trim()).filter(Boolean)), Effect.orElseSucceed(() => [])));
+	/**
+	* Paths a phase whose write carries a decision already touched this run. A move of one would
+	* fold that phase's edit into a rename a reviewer reads elsewhere; a SWEEP has no such edit.
+	* Read BEFORE the batch loop, so a set that cannot be read costs no model call.
+	*/
+	const touched = yield* touchedThisRun(env.deps.git, env.baseSha);
 	const batches = assembleBatches([candidates], { maxMembers: 16 });
 	const counts = {
 		candidates: candidates.length,
@@ -15844,7 +16060,22 @@ const placementTriage = (env) => Effect.gen(function* () {
 		keptInbox: 0,
 		newDirs: 0,
 		budgetSkipped: 0,
-		failed: 0
+		failed: 0,
+		existingDirs: existingDirs.length,
+		touchedFiles: touched.kind === "unknown" ? 0 : touched.paths.size,
+		touchedCommits: touched.kind === "scoped" ? touched.commits : 0,
+		sweepCommits: touched.kind === "scoped" ? touched.sweeps : 0,
+		touchedWidened: touched.kind === "widened" ? 1 : 0,
+		...Object.fromEntries(Object.keys(PLACEMENT_REFUSALS).map((key) => [key, 0]))
+	};
+	/**
+	* A touched set neither read could establish is a degradation, reported the way an absent model
+	* is: a reason, nothing written, nothing committed. Moving under it would be moving without the
+	* guard, and the corpus is still there tomorrow.
+	*/
+	if (touched.kind === "unknown") return {
+		...emptyOutcome(counts),
+		detail: "the run's touched set could not be read"
 	};
 	if (batches.length === 0 || env.dryRun) return emptyOutcome(counts);
 	const modelKey = modelFor(env.deps, "placement-triage");
@@ -15887,41 +16118,46 @@ const placementTriage = (env) => Effect.gen(function* () {
 			}
 			const refuse = (reason) => {
 				counts.refused = (counts.refused ?? 0) + 1;
-				return Effect.logWarning(`sleep.placement refused ${row.path} -> ${destination}: ${reason}`);
+				counts[reason] = (counts[reason] ?? 0) + 1;
+				return Effect.logWarning(`sleep.placement refused ${row.path} -> ${destination}: ${PLACEMENT_REFUSALS[reason]}`);
 			};
 			if (placement.confidence < .7) {
-				yield* refuse("below the confidence floor");
+				yield* refuse("refusedLowConfidence");
 				continue;
 			}
 			const bucket = paraBucketOf(destination);
 			if (bucket !== "areas" && bucket !== "resources" || managed.has(destination) || destination === row.path.slice(0, row.path.lastIndexOf("/")) || destination.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
-				yield* refuse("not a placeable directory");
+				yield* refuse("refusedDestination");
 				continue;
 			}
 			if (isSleepExcluded(row.memory_type)) {
-				yield* refuse("tasks never move");
+				yield* refuse("refusedTask");
+				continue;
+			}
+			if (touched.paths.has(row.path)) {
+				yield* refuse("refusedTouched");
 				continue;
 			}
-			if (touched.has(row.path) || movedFrom.has(row.path)) {
-				yield* refuse("another phase touched this file this run");
+			if (movedFrom.has(row.path)) {
+				yield* refuse("refusedAlreadyMoved");
 				continue;
 			}
 			const isNew = !existingDirs.includes(destination) && !mintedDirs.has(destination);
 			if (isNew && mintedDirs.size >= 5) {
-				yield* refuse("the new-directory cap for this run is spent");
+				yield* refuse("refusedNewDirCap");
 				continue;
 			}
 			const target = `${destination}/${row.path.slice(row.path.lastIndexOf("/") + 1)}`;
 			if (!isValidMemoryPath(target)) {
-				yield* refuse("the destination path is not a valid memory path");
+				yield* refuse("refusedInvalidPath");
 				continue;
 			}
 			if ((yield* readFileBytes(env, target)) !== void 0) {
-				yield* refuse("the destination already holds a file by that name");
+				yield* refuse("refusedCollision");
 				continue;
 			}
 			if ((yield* readFileBytes(env, row.path)) === void 0) {
-				yield* refuse("the source file is already gone from the tree");
+				yield* refuse("refusedSourceGone");
 				continue;
 			}
 			yield* attemptIo(`sleep.placement.mkdir:${target}`, async () => {
@@ -19440,4 +19676,4 @@ const latest = (left, right) => left === null ? right : right === null ? left :
 
 //#endregion
 export { expandRoot as $, EMBED_DIM as A, reinforce as B, discriminationGate as C, wrapAsData as D, ModelClientLive as E, readWatermark as F, makeGitPort as G, makeIndexer as H, Retrieval as I, makeDatabase as J, sanitizeFtsQuery as K, makeRetrieval as L, IndexRecorder as M, makeIndexRecorder as N, Embeddings as O, persistScanned as P, Store as Q, facetConditions as R, DiscriminationFailed as S, ModelClient as T, readIndexState as U, Indexer as V, IndexGit as W, STATE_MIGRATIONS_DIR as X, MIGRATIONS_DIR as Y, STATE_SCHEMA as Z, link as _, REINFORCE_SIGNALS as _t, parseSidecar as a, attemptIo as at, SLEEP_PHASES as b, archivedFormOf as c, Git as ct, accessRows as d, checkMemory as dt, makeStore as et, allPaths as f, parseMemory as ft, hrefFor as g, fenceOpeningOf as gt, applyHeadEdits as h, closesFence as ht, makeSleep as i, STATE_SIDECAR_PATH as it, EMBED_WATERMARK as j, EmbeddingsLive as k, generateArtifacts as l, makeGit as lt, publishRows as m, isValidDatetime as mt, scanTraceRoot as n, SLEEP_REPORTS_DIR as nt, renderSidecar as o, initRepo as ot, danglingEdges as p, setMeta as pt, DatabaseService as q, Sleep as r, STATE_DB_PATH as rt, reportFilename as s, readFileOrNull as st, mergeTailExtract as t, INDEX_DB_PATH as tt, DETECTION_PREFIX as u, commitSubject as ut, meta as v, frameKeyOf as vt, runDiscrimination as w, isSleepPhase as x, unlink as y, parseFacetFilters as z };
-//# sourceMappingURL=dist-D1wH0oJ0.mjs.map
+//# sourceMappingURL=dist-xlKgJuWn.mjs.map