pi-memory-evolution 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to pi-memory-evolution are documented here.
 
+## [0.4.0](https://github.com/btnalit/pi-memory-evolution/compare/v0.3.2...v0.4.0) (2026-09-10)
+
+
+### Features
+
+* confirm memories from evidence already in hand, and let every kind go dormant ([#28](https://github.com/btnalit/pi-memory-evolution/issues/28)) ([150bdbd](https://github.com/btnalit/pi-memory-evolution/commit/150bdbd82a86b57eb43d1197251411d2bba35b3c))
+
+## [0.3.2](https://github.com/btnalit/pi-memory-evolution/compare/v0.3.1...v0.3.2) (2026-09-10)
+
+
+### Bug Fixes
+
+* apply the candidate cap after the containment filter, not before ([#26](https://github.com/btnalit/pi-memory-evolution/issues/26)) ([58cccac](https://github.com/btnalit/pi-memory-evolution/commit/58cccac3ee9367a3c9c386ac9d0686198493a926))
+
 ## [0.3.1](https://github.com/btnalit/pi-memory-evolution/compare/v0.3.0...v0.3.1) (2026-09-10)
 
 

package/docs/core-quality.md

@@ -67,8 +67,9 @@ not inherit old utility/accuracy feedback. A literal correction clears old alias
 feedback; undo restores the actual prior metadata.
 
 **Limit:** conflict detection still depends on the model identifying a `replaces` target
-in its candidate set, which the host now selects by what the source mentions rather than by
-what is recent. Records the source never mentions are out of reach for that source. Arbitrary contradictory additions, paraphrases
+in its candidate set, which the host selects by what the source mentions, then caps by recency.
+Records the source never mentions are out of reach for that source, and so are mentioned ones
+older than the 32 most recent that qualify. Arbitrary contradictory additions, paraphrases
 and cross-origin identities are not automatically resolved. Multiple source events are
 not treated as independent corroboration; repeated summaries may share the same root
 observation. There is no reinforcement count or model-generated confidence score.
@@ -82,18 +83,38 @@ refresh is required. All times are numeric and negative ages clamp to zero.
 freshness = floor + (1 - floor) * 2 ** (-ageDays / halfLifeDays)
 ```
 
-| Kind | Half-life of the decaying portion | Floor | Hard recall expiry |
+| Kind | Half-life of the decaying portion | Floor | Dormant after |
 |---|---:|---:|---|
-| project_state | 3 days | 0.50 | after 7 days |
-| fact | 90 days | 0.75 | none |
-| decision | 180 days | 0.85 | none |
-| preference | 365 days | 0.95 | none |
-
-Pinning sets freshness to 1 and exempts age expiry, but adds no credibility, cannot
-revive a conflict, and cannot bypass relevance. Facts/decisions/preferences never vanish
-just because they are old. The project-state cap remains unchanged so upgrading does not
-revive already expired project claims. This first step classifies by memory kind, not
-semantic subtypes such as completed/blocked tasks or volatile configuration facts.
+| project_state | 3 days | 0.50 | 7 days |
+| fact | 60 days | 0.50 | 180 days |
+| decision | 120 days | 0.60 | 365 days |
+| preference | 240 days | 0.70 | 730 days |
+
+Age is not evidence of falsity, so time never deletes anything: only contradicting evidence
+does, through `replaces`. **Dormant means no longer offered, not gone.** A dormant record is
+still stored, still returned by an explicit recall that asks for it, and still shown to the
+model as a replacement candidate — which is the channel that revives it, with no human step.
+
+Decay and dormancy run from the last time a record was **confirmed**, not the last time it was
+edited. Two signals already present in a learning call supply that, so neither costs a request:
+the model re-deriving content this origin already holds, and a record the host measured the
+source to mention being left standing beside it. The second means *not disputed by evidence
+that mentioned it* — never *verified* — so it feeds the clock and nothing else, and it is not
+counted for `project_state`, whose states go stale silently, nor for `progress` sources, whose
+candidates are host-nominated rather than measured. Confirmation never moves `updatedAt`: that
+is the replacement authority gate, and moving it would make a refreshed record refuse a
+legitimately older queued source. A known residual: a weak model that fails to supersede a
+false record keeps its clock alive by leaving it standing. That is the existing supersession
+failure, not a new one.
+
+The floors used to be high because nothing could refresh a record, which left decay nearly
+inert — a preference could lose at most 5 percentage points in its entire life. Reinforcement
+is that missing mechanism, so the floors come down and freshness does real ranking work.
+
+Pinning sets freshness to 1 and exempts a record from dormancy, but adds no credibility, cannot
+revive a conflict, and cannot bypass relevance. The project-state horizon is unchanged, so
+upgrading does not revive already dormant project claims. This first step classifies by memory
+kind, not semantic subtypes such as completed/blocked tasks or volatile configuration facts.
 
 The existing lexical score and subject/literal/coverage/relative-cutoff gates run first.
 The 75% relative cutoff is based on **raw relevance**, not quality-adjusted scores.

package/docs/design.md

@@ -112,11 +112,20 @@ are clipped with an ellipsis/hash suffix. Origins are provenance hints, not evid
 that another project's fact applies here. Identical content is deduplicated only within
 one origin: equal port/path text from different contexts can mean different facts.
 
-Forgotten/conflicted claims never recall. Unpinned project-state claims expire from recall
-after 7 days; facts/preferences/decisions have no automatic age deletion. All kinds have
-bounded gradual freshness decay, with separate half-lives/floors and pin exemption.
+Forgotten/conflicted claims never recall. Every unpinned kind becomes **dormant** past its own
+horizon — 7 days for project state, 180 for facts, 365 for decisions, 730 for preferences — which
+stops it being offered for injection without deleting it: it stays stored, stays recallable on
+request, and stays a replacement candidate, so later evidence can revive or retire it with no
+human step. No kind has automatic age deletion. All kinds have bounded gradual freshness decay,
+with separate half-lives/floors and pin exemption. Decay and dormancy run from the last
+confirmation rather than the last edit; `updatedAt`, the replacement authority gate, never moves
+for a confirmation.
 Pin/unpin, legacy annotation, explicit feedback and conflict resolution preserve the evidence
-date, and undo restores the prior date. Event history separately records when an operation occurred.
+date, and undo restores the prior date. Undo also ignores the confirmation stamp when deciding
+whether a record changed, and carries it forward rather than reverting it: confirmation writes no
+event, so an event snapshot can never carry a later stamp, and comparing it would make every
+confirmed record permanently un-undoable. Event history separately records when an operation
+occurred.
 
 See [core-quality.md](core-quality.md) for the evidence contract, exact ranking policy,
 weaker-replacement guard, replay-safe feedback and read-only mid-task `memory_recall` tool.
@@ -178,6 +187,10 @@ Jaccard, because a source is orders of magnitude longer than a claim. A progress
 uses exactly the records nominated in `targets`.
 
 This is a **filter, never a ranking**, and the qualifying records keep the original recency order.
+The cap applies **after** the filter, not before: capping by recency first meant a scope holding more
+than 32 records could never show an older one again, however squarely the source was about it, so it
+could never be superseded — only accumulated alongside. Reach is still bounded by the 32 most recent
+qualifying records, and ordering stays by update time, never by recency of confirmation.
 Containment is highest for a record the source merely restates and lower for the one it
 contradicts, because the changed value is exactly the term that is missing; ordering by it and
 cutting to a small cap would drop the record that most needed superseding, and both versions

package/docs/usage.md

@@ -111,7 +111,9 @@ rename the tool to hide the conflict; an old installation would still run its ho
 - Each processing attempt makes at most one background model call, using up to 32
   recently updated active memories from that source's capture origin **that the source
   actually mentions** — the host filters the rest out, so a source cannot replace a
-  record it never talks about. This is a
+  record it never talks about. The filter runs **before** the cap, so an older record the
+  source is squarely about is no longer hidden behind newer unrelated ones; reach is still
+  bounded by the 32 most recent records that qualify. This is a
   conservative automatic-replacement safeguard, **not a recall restriction**.
   It defaults to **the current Pi session model and Pi's own provider/auth resolution**.
   With no session override, this is Pi's configured default. Quota/rate limits or repeated
@@ -213,9 +215,16 @@ history, correction, pinning and undo rather than treating generated claims as v
   is withheld and its new variant quarantined, with history. Current user corrections
   and new tool-backed project progress can still update automatically; pins remain protected.
 - Freshness decreases smoothly by type: project state fastest, then facts, decisions,
-  preferences. Stable kinds retain a nonzero floor and do not expire. Project states keep
-  the seven-day safety cap; no upgrade revives old states. Read/search/injection, pinning,
-  alias enrichment, feedback and conflict resolution do not reset the evidence clock.
+  preferences. Every kind retains a nonzero floor, and past its own horizon becomes
+  **dormant** — no longer injected automatically, but still stored, still returned by the
+  `memory_recall` tool and by `/memory search`, and still offered to learning, so later evidence
+  revives or retires it without you doing anything. Dormancy governs what is pushed into a
+  session unprompted; it never makes a record unfindable for someone looking for it.
+  Project states keep the seven-day cap; no upgrade revives old states. Read/search/injection,
+  pinning, alias enrichment, feedback and conflict resolution never move the evidence date,
+  and nothing does except a replacement. The separate decay clock is moved only by a later
+  source that mentions a record and either leaves it standing or reaffirms it outright — never
+  for project states, whose seven-day cap nothing resets.
 - Ranking keeps **relevance, evidence, freshness and feedback separate**. Quality cannot
   rescue an unrelated/weak lexical match. `useful` is not `accurate`; neither is independent
   verification. Repeated retrieval or repeated positive feedback earns no cumulative boost.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-memory-evolution",
-	"version": "0.3.1",
+	"version": "0.4.0",
 	"description": "Memory that maintains itself. Pi learns what matters, injects what this session needs, and recalls the rest — nothing to configure, no commands to learn.",
 	"license": "MIT",
 	"publishConfig": {

package/src/index.ts

@@ -195,7 +195,9 @@ export default async function memoryEvolution(pi: ExtensionAPI, dependencies: Me
 			if (lifetime.signal.aborted || signal?.aborted) throw new Error("Memory recall cancelled");
 			try {
 				const query = resolveRecallQuery(redact(params.query));
-				const result = retrieveMemories(query.query ? getStore().readMemories() : [], query);
+				// Asked for explicitly, so dormancy does not apply: it governs what is pushed into a session
+				// unprompted, not what can be found. Dormant records come back marked `aging`.
+				const result = retrieveMemories(query.query ? getStore().readMemories() : [], query, 3, Date.now(), { includeDormant: true });
 				const text = buildRuntimeDigest(result.selected, query) ?? "No matching recallable memory. This is not proof the subject was never stored; try a specific subject or known alias, not arbitrary recent records.";
 				return { content: [{ type: "text" as const, text }], details: { matches: text.split('\n').filter(line => line.startsWith('{')).length } };
 			} catch { throw new Error("Memory recall failed; inspect /memory status. No memory update was performed."); }
@@ -249,7 +251,9 @@ export default async function memoryEvolution(pi: ExtensionAPI, dependencies: Me
 						: operation === "list" && id === "here" ? scope : undefined);
 					let pageInfo = "";
 					if (operation === "show") memories = memories.filter((m) => m.id === id);
-					else if (operation === "search") memories = selectRelevantMemories(memories, recallQuery([id, value].filter(Boolean).join(" ")), 10);
+					// An explicit search must find what is stored, including dormant records: dormancy stops a
+					// record being offered unprompted, and must never make it unfindable for someone looking.
+					else if (operation === "search") memories = selectRelevantMemories(memories, recallQuery([id, value].filter(Boolean).join(" ")), 10, Date.now(), { includeDormant: true });
 					else {
 						const filtered = id === "all" || id === "legacy" || id === "here";
 						const pageText = (filtered ? value : id) || "1";

package/src/injector/digest.ts

@@ -16,7 +16,9 @@ export function buildRuntimeDigest(memories: readonly DurableMemory[], prompt: R
 		const text = excerpt(memory.content, prompt, 400);
 		const line = JSON.stringify({ id: label(memory.id), kind: memory.kind, status: memory.status,
 			origin: label(memory.scope), source: label(memory.evidence?.sourceId ?? memory.sourceEntryId), updated: memory.updatedAt.slice(0,10),
-			evidence: `${quality.basis}/${quality.method}`, aging: quality.freshness < 0.85,
+			// The freshness anchor, shown only when later evidence actually moved it past the edit date.
+			...(quality.confirmedAt.slice(0,10) > memory.updatedAt.slice(0,10) ? { confirmed: quality.confirmedAt.slice(0,10) } : {}),
+			evidence: `${quality.basis}/${quality.method}`, aging: quality.aging,
 			...(memory.feedback?.accuracy ? { assessment: memory.feedback.accuracy.verdict } : {}), text }) + "\n";
 		if (Buffer.byteLength(digest + line) <= MAX_BYTES) digest += line;
 	}

package/src/memory/limits.ts

@@ -35,9 +35,21 @@ export const MAX_SEARCH_TERM_CHARS = 64;
  * source merely restates and lower for the one it contradicts — the changed value is exactly
  * the term that is missing — so ordering by it drops the record that most needs superseding.
  * IDF weighting makes that worse, not better: the missing term is the rare one. Qualifying
- * records therefore keep the original recency order, and the cap only bounds the payload. */
+ * records therefore keep the original recency order, and the cap below takes the most recent. */
 export const RELATED_CONTAINMENT = 0.4;
-/** Unchanged from the recency-only selection this filter narrows, so nothing once shown is cut. */
+/** How many qualifying records may be sent. Applied AFTER the containment filter, never before:
+ * capping by recency first meant a scope with more than 32 records could never show an older one
+ * again, however squarely the source was about it, so it could never be superseded — only
+ * accumulated alongside. Measured on a live 89-record scope, 46 relevant records were unreachable
+ * that way, including the exact record a user correction was aimed at (rank 63, top containment).
+ *
+ * Nothing once shown is cut: a record inside the recency top-32 overall is necessarily among the
+ * 32 most recent qualifying records, so the old selection is a subset of this one.
+ *
+ * Residual, deliberately accepted: reach is still bounded by "the 32 most recent that qualify".
+ * Containment saturates on long summary sources (38 of 89 records scored 1.00), so in a busy scope
+ * the oldest still do not re-enter. Ordering stays by `updatedAt` and must not become recency of
+ * confirmation, or records would be shown because they were recently shown. */
 export const MAX_CANDIDATES = 32;
 
 /** What a reply may cost us, derived from the contract above rather than invented. These are

package/src/memory/memory-store.ts

@@ -37,6 +37,11 @@ export interface DurableMemory {
 	/** Exact superseded content, carried across explicit legacy adoption. */
 	suppressedHashes?: string[];
 	searchTerms?: string[];
+	/** When this record was last confirmed by later evidence, as distinct from last changed. Decay
+	 * and dormancy run from it; `updatedAt` does not move, because it is the replacement authority
+	 * gate and moving it would make a refreshed record refuse a legitimately older queued source.
+	 * Missing on records nothing has reconfirmed, which simply means decay runs from `updatedAt`. */
+	reinforcedAt?: string;
 	/** Host-assigned provenance; missing on old records means unknown, never verified. */
 	evidence?: Evidence;
 	feedback?: MemoryFeedback;
@@ -245,6 +250,25 @@ export class MemoryStore {
 	private generation(scope: string): number {
 		return Number(this.db.prepare("SELECT COALESCE(MAX(rowid),0) AS n FROM events WHERE scope=?").get(scope)!.n);
 	}
+	/** Confirmation is not a change: no content, evidence, status or `updatedAt` moves, so it writes
+	 * no event and creates no undo point - there is nothing to undo about having been mentioned. Only
+	 * `reinforcedAt` moves, and only forward, so replay or an out-of-order source cannot roll it back.
+	 * Pinned records are skipped because their freshness is already fixed at 1. */
+	private reinforce(ids: Iterable<string>, at: string): void {
+		const stamp = Date.parse(at);
+		if (!Number.isFinite(stamp)) return;
+		let touched = false;
+		for (const id of ids) {
+			const memory = this.get(id);
+			if (!memory || !active(memory) || memory.layer === "pinned") continue;
+			if (stamp <= Math.max(Date.parse(memory.updatedAt), Date.parse(memory.reinforcedAt ?? "") || 0)) continue;
+			const next = { ...memory, reinforcedAt: new Date(stamp).toISOString() };
+			if (!isMemory(next)) throw new Error("Invalid memory update");
+			this.db.prepare("UPDATE memories SET data=? WHERE id=?").run(JSON.stringify(next), id);
+			touched = true;
+		}
+		if (touched) this.cache.clear();
+	}
 	private record(actor: string, reason: string, after: DurableMemory[], scope: string): string {
 		const before = after.map((m) => this.get(m.id) ?? null);
 		const at = new Date().toISOString();
@@ -314,6 +338,39 @@ export class MemoryStore {
 			.get(...(scope === undefined ? [] : [scope]), now);
 		return row ? String(row.id) : undefined;
 	}
+	/** The single definition of what a source may reason about locally and what it may be shown.
+	 * The reservation estimate and the run itself must call this same function: an estimate cheaper
+	 * than the payload it authorizes is how a call gets admitted that the provider then refuses.
+	 *
+	 * A progress source arrives with its targets already nominated, so those are its candidates.
+	 * For everything else the host drops records this source never mentions: it cannot supersede
+	 * a fact it does not talk about, and retrieval is the host's job — deterministic and free —
+	 * not something to pay a model to do by handing it every recent record to search through.
+	 *
+	 * `memories` is NOT read-only: `finishEvolution` writes through it, replacing `searchTerms`
+	 * wholesale on an exact-content match and refreshing a duplicate's evidence. Those writes were
+	 * always bounded by the recency window, and must stay bounded, or model output would rewrite
+	 * records the model was never shown — losing aliases it could not have preserved and resetting
+	 * the aging clock on records it never named. So `memories` is the recency window plus whatever
+	 * was actually shown, and nothing else: `candidates` stays a subset, and every record the host
+	 * may write through is one that was either recent or in front of the model. */
+	private selectCandidates(source: Source): { memories: DurableMemory[]; candidates: DurableMemory[] } {
+		const scoped = this.readMemories(source.scope).filter((m) => m.scope === source.scope && active(m)
+			&& (source.kind !== "progress" || (m.kind === "project_state" && source.targets!.includes(m.id))))
+			.sort((a,b) => Date.parse(b.updatedAt)-Date.parse(a.updatedAt));
+		// Order is left alone deliberately. Containment filters; it must never rank. See limits.ts.
+		// The cap is applied AFTER the filter. Capping first hid every matching record that had aged
+		// past the 32 most recent, so in any scope with more than 32 records an older one could never
+		// be shown again, and therefore never superseded — only accumulated alongside.
+		const vocabulary = source.kind === "progress" ? undefined : features(source.content);
+		const candidates = (vocabulary === undefined ? scoped
+			: scoped.filter((m) => mentions(vocabulary, m.content, m.searchTerms) >= RELATED_CONTAINMENT)).slice(0, MAX_CANDIDATES);
+		const recent = scoped.slice(0, MAX_CANDIDATES);
+		const known = new Set(recent.map((m) => m.id));
+		// Older shown records follow the recency window in age order, so this stays recency-ordered.
+		return { memories: [...recent, ...candidates.filter((m) => !known.has(m.id))], candidates };
+	}
+
 	beginEvolution(id: string, retry: RetryMode = false, timeoutMs = EVOLUTION_TIMEOUT_MS, now = Date.now(), model?: string, call?: CallOptions): EvolutionRun | undefined {
 		this.assertLearningReady();
 		return this.transaction(() => {
@@ -324,14 +381,18 @@ export class MemoryStore {
 			this.db.prepare('UPDATE sources SET last_checked=? WHERE id=?').run(now, id);
 			const priorModels = parseModels(row.call_models);
 			const correctOutput = Number(row.corrections) === 0 && Number(row.output_failures) === 1 && ['invalid_output','output_limit'].includes(String(row.last_error));
+			const source = parseSource(row.data);
+			// Selecting candidates scans the whole scope; this transaction holds the write lock, so it is
+			// computed at most once per attempt and only once a route is actually available. The estimate
+			// and the run must see the same set anyway — a cheaper estimate authorizes a larger payload.
+			let selected: { memories: DurableMemory[]; candidates: DurableMemory[] } | undefined;
+			const select = () => (selected ??= this.selectCandidates(source));
 			if (model !== undefined) {
 				model = modelLabel(model);
 				if (retry !== true && !priorModels.includes(model) && priorModels.length >= this.policy.sourceModels) return undefined;
 				const provider = modelLabel(call?.provider ?? model.split('/')[0]);
 				if (retry !== true && routeUntil(this.db, model, provider, now) > now) return undefined;
-				const source = parseSource(row.data);
-				const bytes = Buffer.byteLength(JSON.stringify(source)) + this.readMemories(source.scope)
-					.filter(active).sort((a,b) => Date.parse(b.updatedAt)-Date.parse(a.updatedAt)).slice(0,32)
+				const bytes = Buffer.byteLength(JSON.stringify(source)) + select().candidates
 					.reduce((sum,m) => sum + Buffer.byteLength(JSON.stringify(m)), 0);
 				const reserve = estimatedCost(bytes, call);
 				if (budgetUntil(this.db, model, now, this.policy, reserve) > now) return undefined;
@@ -340,19 +401,8 @@ export class MemoryStore {
 			}
 			timeoutMs = Math.min(timeoutMs, this.policy.timeoutMs, retry === true ? timeoutMs : Math.max(1, this.policy.sourceTimeMs - Number(row.call_ms)));
 			this.db.prepare(`UPDATE sources SET state='running', attempt=attempt+1, lease=? WHERE id=?`).run(now + timeoutMs + LEASE_GRACE_MS, id);
-			const source = parseSource(row.data);
 			if (source.id !== id) throw new Error("Invalid source identity");
-			const memories = this.readMemories(source.scope).filter((m) => m.scope === source.scope && active(m)
-				&& (source.kind !== "progress" || (m.kind === "project_state" && source.targets!.includes(m.id))))
-				.sort((a,b) => Date.parse(b.updatedAt)-Date.parse(a.updatedAt)).slice(0, MAX_CANDIDATES);
-			// A progress source arrives with its targets already nominated, so those are its candidates.
-			// For everything else the host drops records this source never mentions: it cannot supersede
-			// a fact it does not talk about, and retrieval is the host's job — deterministic and free —
-			// not something to pay a model to do by handing it every recent record to search through.
-			// Order is left alone deliberately. Containment filters; it must never rank. See limits.ts.
-			const vocabulary = source.kind === "progress" ? undefined : features(source.content);
-			const candidates = vocabulary === undefined ? memories
-				: memories.filter((m) => mentions(vocabulary, m.content, m.searchTerms) >= RELATED_CONTAINMENT);
+			const { memories, candidates } = select();
 			// The stored diagnostic explains the last completed outcome. Claiming an attempt must not erase it:
 			// a cancelled or interrupted run would otherwise leave a paused source with no recorded reason.
 			return { source, attempt: Number(row.attempt) + 1, generation: this.generation(source.scope), memories, candidates, timeoutMs, correctOutput,
@@ -367,6 +417,8 @@ export class MemoryStore {
 			if (job?.state !== "running" || job.attempt !== run.attempt || this.generation(run.source.scope) !== run.generation) throw new EvolutionError("stale");
 			const after = new Map<string, DurableMemory>();
 			const targets = new Set<string>();
+			const confirmed = new Set<string>();
+			const reaffirmed = new Set<string>();
 			let weakerConflicts = 0;
 			const incoming = sourceEvidence(run.source, "model");
 			// Two different things used to throw the same bare Error and land on write_rejected, which
@@ -412,6 +464,11 @@ export class MemoryStore {
 					targets.add(old.id);
 					if (claim.kind !== old.kind) broke('replaces_kind', index, 'kind');
 					if (fingerprint(old.content) === fingerprint(claim.content)) {
+						// Naming a record and replacing it with itself is an explicit "this still holds", so it
+						// must count at least as much as leaving it standing silently. Without this, a summary
+						// source that reaffirms a record outright moves nothing while one that says nothing
+						// about it confirms it - the stronger signal worth less than the weaker one.
+						reaffirmed.add(old.id);
 						if (run.source.kind !== "summary" && mayReplace(old, incoming)) after.set(old.id, { ...old, sourceEntryId: run.source.id,
 							updatedAt: run.source.createdAt, evidence: incoming, status: "provisional", revision: old.revision + 1 });
 						annotate(old, claim); continue;
@@ -447,7 +504,26 @@ export class MemoryStore {
 					else annotate(run.memories.find((m) => m.kind === claim.kind && fingerprint(m.content) === fingerprint(claim.content)), claim);
 				}
 			}
+			// Shown, measured to be mentioned by this source, and either left standing or explicitly
+			// replaced by identical content: the model saw the record beside fresh evidence about the same
+			// terms and did not contradict it. That is "not disputed by evidence that mentioned it", not
+			// "verified" - enough to keep a record out of dormancy, never enough to raise its authority.
+			//
+			// The model producing content the store already holds is deliberately NOT a signal. The whole
+			// content of every candidate is in front of it and the prompt asks for aliases on unchanged
+			// records, so re-emitting one is the cheapest move available, not independent re-derivation.
+			// Progress sources are excluded because their candidates are host-nominated targets, not
+			// records measured to be mentioned. Today that guard is subsumed by the project_state rule
+			// below - `selectCandidates` only ever nominates project_state for a progress source - so it
+			// has no test of its own. It stays because the two rules answer different questions, and
+			// dropping it would make project_state's rule silently load-bearing for both.
+			// project_state is excluded for the same reason - states go stale silently, and silence is far
+			// too weak to keep resetting the one seven-day safety cap that actually does work.
+			if (run.source.kind !== "progress") for (const shown of run.candidates)
+				if (shown.kind !== "project_state" && (!targets.has(shown.id) || reaffirmed.has(shown.id))) confirmed.add(shown.id);
 			const event = this.record("model", `${model}: ${run.source.id}${weakerConflicts ? `; weaker replacements withheld=${weakerConflicts}` : ""}`, [...after.values()], run.source.scope);
+			// After `record`, so a record this batch also changed is confirmed on top of that change.
+			this.reinforce(confirmed, run.source.createdAt);
 			this.db.prepare("UPDATE sources SET state='done',lease=0,failures=0,output_failures=0,retry_at=0,failed_at=0,last_error='',diagnostic=? WHERE id=?")
 				.run(JSON.stringify(diagnostic), run.source.id);
 			finishCall(this.db, run.source.id, run.attempt, 'done', Date.now(), '', diagnostic);
@@ -630,10 +706,18 @@ export class MemoryStore {
 			if (!row) throw new Error("Unknown event id");
 			const event = parseEvent(row.data, id, row.scope);
 			if (!event.after.length) throw new Error("Event has no memory changes");
+			// `reinforcedAt` is deliberately outside this comparison. Confirmation writes no event, so an
+			// event's snapshot can never carry a stamp written after it; comparing it would make every
+			// confirmed record permanently un-undoable. It is also not part of what an undo restores -
+			// there is nothing to undo about having been mentioned - so the current stamp is carried
+			// forward onto the restored record rather than reverted with it.
+			const settled = (memory: DurableMemory | undefined) => memory && JSON.stringify({ ...memory, reinforcedAt: undefined });
 			const restored = event.after.map((after, i) => {
-				if (JSON.stringify(this.get(after.id)) !== JSON.stringify(after)) throw new Error("Memory changed since this event; undo refused");
+				const current = this.get(after.id);
+				if (settled(current) !== settled(after)) throw new Error("Memory changed since this event; undo refused");
 				this.block(after);
 				return { ...(event.before[i] ?? { ...after, status: "forgotten" as const }), revision: after.revision + 1,
+					...(current?.reinforcedAt ? { reinforcedAt: current.reinforcedAt } : {}),
 					suppressedHashes: [...new Set([...(event.before[i]?.suppressedHashes ?? []), ...(after.suppressedHashes ?? []), fingerprint(after.content)])] };
 			});
 			return this.record("manual", `Undo ${id}`, restored, event.scope);
@@ -711,6 +795,7 @@ function isMemory(value: unknown): value is DurableMemory {
 		&& (m.suppressedHashes === undefined || (Array.isArray(m.suppressedHashes) && m.suppressedHashes.every((h) => typeof h === "string" && /^[a-f0-9]{24}$/u.test(h))))
 		&& typeof m.createdAt === "string" && typeof m.updatedAt === "string"
 		&& Number.isFinite(Date.parse(m.createdAt)) && Number.isFinite(Date.parse(m.updatedAt))
+		&& (m.reinforcedAt === undefined || (typeof m.reinforcedAt === "string" && Number.isFinite(Date.parse(m.reinforcedAt))))
 		&& Number.isInteger(m.revision) && m.revision > 0 && ["durable", "pinned"].includes(m.layer)
 		&& ["provisional", "confirmed", "forgotten", "conflicted"].includes(m.status);
 }

package/src/memory/quality.ts

@@ -56,26 +56,47 @@ export function mayReplace(old: DurableMemory, incoming: Evidence): boolean {
 }
 
 const DAY = 86400_000;
-/** No new expiry for stable facts/preferences/decisions and no revival of old states.
- * Floors preserve old useful knowledge; project states retain their seven-day safety cap. */
-export const AGING: Record<MemoryKind, { halfLifeDays: number; floor: number; expiresDays?: number }> = {
-	project_state: { halfLifeDays: 3, floor: 0.5, expiresDays: 7 },
-	fact: { halfLifeDays: 90, floor: 0.75 },
-	decision: { halfLifeDays: 180, floor: 0.85 },
-	preference: { halfLifeDays: 365, floor: 0.95 },
+/** Age is not evidence of falsity. A preference nobody has restated in a year is almost certainly
+ * still true, and a fact nobody has restated in three months might be false — age alone cannot tell
+ * them apart, so time never deletes anything here. Only contradicting evidence does, through
+ * `replaces`. What time does is stop a record being *offered*: past `dormantDays` it is no longer
+ * injected, while staying stored, recallable on request and eligible as a replacement candidate, so
+ * a source that mentions it again revives it with no human step. See `reinforcedAt`.
+ *
+ * The horizons are reasoned, not fitted - the store is far too young to fit them to. A statement
+ * about in-flight work is worthless after a week. An environment fact nobody has confirmed in half
+ * a year is unreliable. A decision unreferenced for a year has usually been overtaken by unrecorded
+ * practice. A preference is the most persistent thing a user tells us, so it gets two years.
+ *
+ * The floors were high because nothing could refresh a record: they had to protect knowledge that
+ * had no other way to stay fresh, which left decay inert (a preference could lose at most 5pp in
+ * its whole life). Reinforcement is that other way, so the floors come down and decay does real
+ * ranking work again. A floor is what a never-reconfirmed record still counts for at its horizon. */
+export const AGING: Record<MemoryKind, { halfLifeDays: number; floor: number; dormantDays: number }> = {
+	project_state: { halfLifeDays: 3, floor: 0.5, dormantDays: 7 },
+	fact: { halfLifeDays: 60, floor: 0.5, dormantDays: 180 },
+	decision: { halfLifeDays: 120, floor: 0.6, dormantDays: 365 },
+	preference: { halfLifeDays: 240, floor: 0.7, dormantDays: 730 },
 };
 export function memoryQuality(memory: DurableMemory, now = Date.now()) {
 	const policy = AGING[memory.kind];
-	const ageDays = Math.max(0, (now - Date.parse(memory.updatedAt)) / DAY);
+	// Decay runs from the last time the record was confirmed, not the last time it was edited.
+	// `updatedAt` remains the replacement authority gate and is never moved by confirmation.
+	const confirmed = Math.max(Date.parse(memory.updatedAt), Date.parse(memory.reinforcedAt ?? "") || 0);
+	const ageDays = Math.max(0, (now - confirmed) / DAY);
 	const pinned = memory.layer === "pinned";
 	const freshness = pinned ? 1 : policy.floor + (1 - policy.floor) * 2 ** (-ageDays / policy.halfLifeDays);
-	const expired = !pinned && policy.expiresDays !== undefined && ageDays > policy.expiresDays;
+	const dormant = !pinned && ageDays > policy.dormantDays;
+	// Shown to the model as a caution once a record is halfway to dormancy, relative to its own
+	// horizon rather than a fixed freshness number, which the floors would make meaningless.
+	const aging = !pinned && ageDays > policy.dormantDays / 2;
 	const basis = memory.evidence?.basis ?? "unknown";
 	const priority = evidencePriority(memory.kind, memory.evidence?.basis);
 	const evidenceWeight = 1 + priority * 0.04;
 	// Last explicit verdict wins, not frequency. Usefulness never increases evidence priority.
 	const utility = memory.feedback?.utility?.verdict === "useful" ? 1.05 : memory.feedback?.utility?.verdict === "unhelpful" ? 0.9 : 1;
 	const accuracy = memory.feedback?.accuracy?.verdict === "accurate" ? 1.05 : memory.feedback?.accuracy?.verdict === "incorrect" ? 0.5 : 1;
-	return { basis, method: memory.evidence?.method ?? "unknown", ageDays, freshness, expired,
+	return { basis, method: memory.evidence?.method ?? "unknown", ageDays, freshness, dormant, aging,
+		confirmedAt: new Date(confirmed).toISOString(),
 		evidenceWeight, utility, accuracy, factor: freshness * evidenceWeight * utility * accuracy };
 }

package/src/memory/retriever.ts

@@ -12,7 +12,7 @@ function overlap(text: string, query: Set<string>): number {
 
 /** Relevance scores are NOT confidence/truth scores. No authority bonus for cwd,
  * legacy labels, source IDs or dates. Metadata can only help an explicit origin query. */
-type RecallOptions = { includeExpiredProjectState?: boolean };
+type RecallOptions = { includeDormant?: boolean };
 type RankedMemory = { memory: DurableMemory; score: number; rankScore: number; quality: ReturnType<typeof memoryQuality>; coverage: number; matches: string[]; reason?: string };
 export interface RecallDiagnostics {
 	mode: string;
@@ -34,7 +34,7 @@ function evaluate(memories: readonly DurableMemory[], prompt: RecallInput, now:
 	const qualities = new Map(memories.map(m => [m.id, memoryQuality(m, now)]));
 	const excludedReason = (m: DurableMemory) => ["forgotten", "conflicted"].includes(m.status) ? m.status
 		: m.feedback?.accuracy?.verdict === "incorrect" ? "disputed"
-		: !options.includeExpiredProjectState && qualities.get(m.id)!.expired ? "expired-project-state" : undefined;
+		: !options.includeDormant && qualities.get(m.id)!.dormant ? "dormant" : undefined;
 	const active = memories.filter(m => !excludedReason(m));
 	const diagnostics: RecallDiagnostics = { mode: plan.mode, query: [...query].slice(0, 32), context: [...context].slice(0, 32),
 		eligible: active.length, excluded: memories.length - active.length, matched: 0, selected: [], candidates: [],