pi-memory-evolution 0.3.2 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to pi-memory-evolution are documented here.
 
+## [0.4.0](https://github.com/btnalit/pi-memory-evolution/compare/v0.3.2...v0.4.0) (2026-09-10)
+
+
+### Features
+
+* confirm memories from evidence already in hand, and let every kind go dormant ([#28](https://github.com/btnalit/pi-memory-evolution/issues/28)) ([150bdbd](https://github.com/btnalit/pi-memory-evolution/commit/150bdbd82a86b57eb43d1197251411d2bba35b3c))
+
 ## [0.3.2](https://github.com/btnalit/pi-memory-evolution/compare/v0.3.1...v0.3.2) (2026-09-10)
 
 

package/docs/core-quality.md

@@ -83,18 +83,38 @@ refresh is required. All times are numeric and negative ages clamp to zero.
 freshness = floor + (1 - floor) * 2 ** (-ageDays / halfLifeDays)
 ```
 
-| Kind | Half-life of the decaying portion | Floor | Hard recall expiry |
+| Kind | Half-life of the decaying portion | Floor | Dormant after |
 |---|---:|---:|---|
-| project_state | 3 days | 0.50 | after 7 days |
-| fact | 90 days | 0.75 | none |
-| decision | 180 days | 0.85 | none |
-| preference | 365 days | 0.95 | none |
-
-Pinning sets freshness to 1 and exempts age expiry, but adds no credibility, cannot
-revive a conflict, and cannot bypass relevance. Facts/decisions/preferences never vanish
-just because they are old. The project-state cap remains unchanged so upgrading does not
-revive already expired project claims. This first step classifies by memory kind, not
-semantic subtypes such as completed/blocked tasks or volatile configuration facts.
+| project_state | 3 days | 0.50 | 7 days |
+| fact | 60 days | 0.50 | 180 days |
+| decision | 120 days | 0.60 | 365 days |
+| preference | 240 days | 0.70 | 730 days |
+
+Age is not evidence of falsity, so time never deletes anything: only contradicting evidence
+does, through `replaces`. **Dormant means no longer offered, not gone.** A dormant record is
+still stored, still returned by an explicit recall that asks for it, and still shown to the
+model as a replacement candidate — which is the channel that revives it, with no human step.
+
+Decay and dormancy run from the last time a record was **confirmed**, not the last time it was
+edited. Two signals already present in a learning call supply that, so neither costs a request:
+the model re-deriving content this origin already holds, and a record the host measured the
+source to mention being left standing beside it. The second means *not disputed by evidence
+that mentioned it* — never *verified* — so it feeds the clock and nothing else, and it is not
+counted for `project_state`, whose states go stale silently, nor for `progress` sources, whose
+candidates are host-nominated rather than measured. Confirmation never moves `updatedAt`: that
+is the replacement authority gate, and moving it would make a refreshed record refuse a
+legitimately older queued source. A known residual: a weak model that fails to supersede a
+false record keeps its clock alive by leaving it standing. That is the existing supersession
+failure, not a new one.
+
+The floors used to be high because nothing could refresh a record, which left decay nearly
+inert — a preference could lose at most 5 percentage points in its entire life. Reinforcement
+is that missing mechanism, so the floors come down and freshness does real ranking work.
+
+Pinning sets freshness to 1 and exempts a record from dormancy, but adds no credibility, cannot
+revive a conflict, and cannot bypass relevance. The project-state horizon is unchanged, so
+upgrading does not revive already dormant project claims. This first step classifies by memory
+kind, not semantic subtypes such as completed/blocked tasks or volatile configuration facts.
 
 The existing lexical score and subject/literal/coverage/relative-cutoff gates run first.
 The 75% relative cutoff is based on **raw relevance**, not quality-adjusted scores.

package/docs/design.md

@@ -112,11 +112,20 @@ are clipped with an ellipsis/hash suffix. Origins are provenance hints, not evid
 that another project's fact applies here. Identical content is deduplicated only within
 one origin: equal port/path text from different contexts can mean different facts.
 
-Forgotten/conflicted claims never recall. Unpinned project-state claims expire from recall
-after 7 days; facts/preferences/decisions have no automatic age deletion. All kinds have
-bounded gradual freshness decay, with separate half-lives/floors and pin exemption.
+Forgotten/conflicted claims never recall. Every unpinned kind becomes **dormant** past its own
+horizon — 7 days for project state, 180 for facts, 365 for decisions, 730 for preferences — which
+stops it being offered for injection without deleting it: it stays stored, stays recallable on
+request, and stays a replacement candidate, so later evidence can revive or retire it with no
+human step. No kind has automatic age deletion. All kinds have bounded gradual freshness decay,
+with separate half-lives/floors and pin exemption. Decay and dormancy run from the last
+confirmation rather than the last edit; `updatedAt`, the replacement authority gate, never moves
+for a confirmation.
 Pin/unpin, legacy annotation, explicit feedback and conflict resolution preserve the evidence
-date, and undo restores the prior date. Event history separately records when an operation occurred.
+date, and undo restores the prior date. Undo also ignores the confirmation stamp when deciding
+whether a record changed, and carries it forward rather than reverting it: confirmation writes no
+event, so an event snapshot can never carry a later stamp, and comparing it would make every
+confirmed record permanently un-undoable. Event history separately records when an operation
+occurred.
 
 See [core-quality.md](core-quality.md) for the evidence contract, exact ranking policy,
 weaker-replacement guard, replay-safe feedback and read-only mid-task `memory_recall` tool.

package/docs/usage.md

@@ -215,9 +215,16 @@ history, correction, pinning and undo rather than treating generated claims as v
   is withheld and its new variant quarantined, with history. Current user corrections
   and new tool-backed project progress can still update automatically; pins remain protected.
 - Freshness decreases smoothly by type: project state fastest, then facts, decisions,
-  preferences. Stable kinds retain a nonzero floor and do not expire. Project states keep
-  the seven-day safety cap; no upgrade revives old states. Read/search/injection, pinning,
-  alias enrichment, feedback and conflict resolution do not reset the evidence clock.
+  preferences. Every kind retains a nonzero floor, and past its own horizon becomes
+  **dormant** — no longer injected automatically, but still stored, still returned by the
+  `memory_recall` tool and by `/memory search`, and still offered to learning, so later evidence
+  revives or retires it without you doing anything. Dormancy governs what is pushed into a
+  session unprompted; it never makes a record unfindable for someone looking for it.
+  Project states keep the seven-day cap; no upgrade revives old states. Read/search/injection,
+  pinning, alias enrichment, feedback and conflict resolution never move the evidence date,
+  and nothing does except a replacement. The separate decay clock is moved only by a later
+  source that mentions a record and either leaves it standing or reaffirms it outright — never
+  for project states, whose seven-day cap nothing resets.
 - Ranking keeps **relevance, evidence, freshness and feedback separate**. Quality cannot
   rescue an unrelated/weak lexical match. `useful` is not `accurate`; neither is independent
   verification. Repeated retrieval or repeated positive feedback earns no cumulative boost.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-memory-evolution",
-	"version": "0.3.2",
+	"version": "0.4.0",
 	"description": "Memory that maintains itself. Pi learns what matters, injects what this session needs, and recalls the rest — nothing to configure, no commands to learn.",
 	"license": "MIT",
 	"publishConfig": {

package/src/index.ts

@@ -195,7 +195,9 @@ export default async function memoryEvolution(pi: ExtensionAPI, dependencies: Me
 			if (lifetime.signal.aborted || signal?.aborted) throw new Error("Memory recall cancelled");
 			try {
 				const query = resolveRecallQuery(redact(params.query));
-				const result = retrieveMemories(query.query ? getStore().readMemories() : [], query);
+				// Asked for explicitly, so dormancy does not apply: it governs what is pushed into a session
+				// unprompted, not what can be found. Dormant records come back marked `aging`.
+				const result = retrieveMemories(query.query ? getStore().readMemories() : [], query, 3, Date.now(), { includeDormant: true });
 				const text = buildRuntimeDigest(result.selected, query) ?? "No matching recallable memory. This is not proof the subject was never stored; try a specific subject or known alias, not arbitrary recent records.";
 				return { content: [{ type: "text" as const, text }], details: { matches: text.split('\n').filter(line => line.startsWith('{')).length } };
 			} catch { throw new Error("Memory recall failed; inspect /memory status. No memory update was performed."); }
@@ -249,7 +251,9 @@ export default async function memoryEvolution(pi: ExtensionAPI, dependencies: Me
 						: operation === "list" && id === "here" ? scope : undefined);
 					let pageInfo = "";
 					if (operation === "show") memories = memories.filter((m) => m.id === id);
-					else if (operation === "search") memories = selectRelevantMemories(memories, recallQuery([id, value].filter(Boolean).join(" ")), 10);
+					// An explicit search must find what is stored, including dormant records: dormancy stops a
+					// record being offered unprompted, and must never make it unfindable for someone looking.
+					else if (operation === "search") memories = selectRelevantMemories(memories, recallQuery([id, value].filter(Boolean).join(" ")), 10, Date.now(), { includeDormant: true });
 					else {
 						const filtered = id === "all" || id === "legacy" || id === "here";
 						const pageText = (filtered ? value : id) || "1";

package/src/injector/digest.ts

@@ -16,7 +16,9 @@ export function buildRuntimeDigest(memories: readonly DurableMemory[], prompt: R
 		const text = excerpt(memory.content, prompt, 400);
 		const line = JSON.stringify({ id: label(memory.id), kind: memory.kind, status: memory.status,
 			origin: label(memory.scope), source: label(memory.evidence?.sourceId ?? memory.sourceEntryId), updated: memory.updatedAt.slice(0,10),
-			evidence: `${quality.basis}/${quality.method}`, aging: quality.freshness < 0.85,
+			// The freshness anchor, shown only when later evidence actually moved it past the edit date.
+			...(quality.confirmedAt.slice(0,10) > memory.updatedAt.slice(0,10) ? { confirmed: quality.confirmedAt.slice(0,10) } : {}),
+			evidence: `${quality.basis}/${quality.method}`, aging: quality.aging,
 			...(memory.feedback?.accuracy ? { assessment: memory.feedback.accuracy.verdict } : {}), text }) + "\n";
 		if (Buffer.byteLength(digest + line) <= MAX_BYTES) digest += line;
 	}

package/src/memory/memory-store.ts

@@ -37,6 +37,11 @@ export interface DurableMemory {
 	/** Exact superseded content, carried across explicit legacy adoption. */
 	suppressedHashes?: string[];
 	searchTerms?: string[];
+	/** When this record was last confirmed by later evidence, as distinct from last changed. Decay
+	 * and dormancy run from it; `updatedAt` does not move, because it is the replacement authority
+	 * gate and moving it would make a refreshed record refuse a legitimately older queued source.
+	 * Missing on records nothing has reconfirmed, which simply means decay runs from `updatedAt`. */
+	reinforcedAt?: string;
 	/** Host-assigned provenance; missing on old records means unknown, never verified. */
 	evidence?: Evidence;
 	feedback?: MemoryFeedback;
@@ -245,6 +250,25 @@ export class MemoryStore {
 	private generation(scope: string): number {
 		return Number(this.db.prepare("SELECT COALESCE(MAX(rowid),0) AS n FROM events WHERE scope=?").get(scope)!.n);
 	}
+	/** Confirmation is not a change: no content, evidence, status or `updatedAt` moves, so it writes
+	 * no event and creates no undo point - there is nothing to undo about having been mentioned. Only
+	 * `reinforcedAt` moves, and only forward, so replay or an out-of-order source cannot roll it back.
+	 * Pinned records are skipped because their freshness is already fixed at 1. */
+	private reinforce(ids: Iterable<string>, at: string): void {
+		const stamp = Date.parse(at);
+		if (!Number.isFinite(stamp)) return;
+		let touched = false;
+		for (const id of ids) {
+			const memory = this.get(id);
+			if (!memory || !active(memory) || memory.layer === "pinned") continue;
+			if (stamp <= Math.max(Date.parse(memory.updatedAt), Date.parse(memory.reinforcedAt ?? "") || 0)) continue;
+			const next = { ...memory, reinforcedAt: new Date(stamp).toISOString() };
+			if (!isMemory(next)) throw new Error("Invalid memory update");
+			this.db.prepare("UPDATE memories SET data=? WHERE id=?").run(JSON.stringify(next), id);
+			touched = true;
+		}
+		if (touched) this.cache.clear();
+	}
 	private record(actor: string, reason: string, after: DurableMemory[], scope: string): string {
 		const before = after.map((m) => this.get(m.id) ?? null);
 		const at = new Date().toISOString();
@@ -393,6 +417,8 @@ export class MemoryStore {
 			if (job?.state !== "running" || job.attempt !== run.attempt || this.generation(run.source.scope) !== run.generation) throw new EvolutionError("stale");
 			const after = new Map<string, DurableMemory>();
 			const targets = new Set<string>();
+			const confirmed = new Set<string>();
+			const reaffirmed = new Set<string>();
 			let weakerConflicts = 0;
 			const incoming = sourceEvidence(run.source, "model");
 			// Two different things used to throw the same bare Error and land on write_rejected, which
@@ -438,6 +464,11 @@ export class MemoryStore {
 					targets.add(old.id);
 					if (claim.kind !== old.kind) broke('replaces_kind', index, 'kind');
 					if (fingerprint(old.content) === fingerprint(claim.content)) {
+						// Naming a record and replacing it with itself is an explicit "this still holds", so it
+						// must count at least as much as leaving it standing silently. Without this, a summary
+						// source that reaffirms a record outright moves nothing while one that says nothing
+						// about it confirms it - the stronger signal worth less than the weaker one.
+						reaffirmed.add(old.id);
 						if (run.source.kind !== "summary" && mayReplace(old, incoming)) after.set(old.id, { ...old, sourceEntryId: run.source.id,
 							updatedAt: run.source.createdAt, evidence: incoming, status: "provisional", revision: old.revision + 1 });
 						annotate(old, claim); continue;
@@ -473,7 +504,26 @@ export class MemoryStore {
 					else annotate(run.memories.find((m) => m.kind === claim.kind && fingerprint(m.content) === fingerprint(claim.content)), claim);
 				}
 			}
+			// Shown, measured to be mentioned by this source, and either left standing or explicitly
+			// replaced by identical content: the model saw the record beside fresh evidence about the same
+			// terms and did not contradict it. That is "not disputed by evidence that mentioned it", not
+			// "verified" - enough to keep a record out of dormancy, never enough to raise its authority.
+			//
+			// The model producing content the store already holds is deliberately NOT a signal. The whole
+			// content of every candidate is in front of it and the prompt asks for aliases on unchanged
+			// records, so re-emitting one is the cheapest move available, not independent re-derivation.
+			// Progress sources are excluded because their candidates are host-nominated targets, not
+			// records measured to be mentioned. Today that guard is subsumed by the project_state rule
+			// below - `selectCandidates` only ever nominates project_state for a progress source - so it
+			// has no test of its own. It stays because the two rules answer different questions, and
+			// dropping it would make project_state's rule silently load-bearing for both.
+			// project_state is excluded for the same reason - states go stale silently, and silence is far
+			// too weak to keep resetting the one seven-day safety cap that actually does work.
+			if (run.source.kind !== "progress") for (const shown of run.candidates)
+				if (shown.kind !== "project_state" && (!targets.has(shown.id) || reaffirmed.has(shown.id))) confirmed.add(shown.id);
 			const event = this.record("model", `${model}: ${run.source.id}${weakerConflicts ? `; weaker replacements withheld=${weakerConflicts}` : ""}`, [...after.values()], run.source.scope);
+			// After `record`, so a record this batch also changed is confirmed on top of that change.
+			this.reinforce(confirmed, run.source.createdAt);
 			this.db.prepare("UPDATE sources SET state='done',lease=0,failures=0,output_failures=0,retry_at=0,failed_at=0,last_error='',diagnostic=? WHERE id=?")
 				.run(JSON.stringify(diagnostic), run.source.id);
 			finishCall(this.db, run.source.id, run.attempt, 'done', Date.now(), '', diagnostic);
@@ -656,10 +706,18 @@ export class MemoryStore {
 			if (!row) throw new Error("Unknown event id");
 			const event = parseEvent(row.data, id, row.scope);
 			if (!event.after.length) throw new Error("Event has no memory changes");
+			// `reinforcedAt` is deliberately outside this comparison. Confirmation writes no event, so an
+			// event's snapshot can never carry a stamp written after it; comparing it would make every
+			// confirmed record permanently un-undoable. It is also not part of what an undo restores -
+			// there is nothing to undo about having been mentioned - so the current stamp is carried
+			// forward onto the restored record rather than reverted with it.
+			const settled = (memory: DurableMemory | undefined) => memory && JSON.stringify({ ...memory, reinforcedAt: undefined });
 			const restored = event.after.map((after, i) => {
-				if (JSON.stringify(this.get(after.id)) !== JSON.stringify(after)) throw new Error("Memory changed since this event; undo refused");
+				const current = this.get(after.id);
+				if (settled(current) !== settled(after)) throw new Error("Memory changed since this event; undo refused");
 				this.block(after);
 				return { ...(event.before[i] ?? { ...after, status: "forgotten" as const }), revision: after.revision + 1,
+					...(current?.reinforcedAt ? { reinforcedAt: current.reinforcedAt } : {}),
 					suppressedHashes: [...new Set([...(event.before[i]?.suppressedHashes ?? []), ...(after.suppressedHashes ?? []), fingerprint(after.content)])] };
 			});
 			return this.record("manual", `Undo ${id}`, restored, event.scope);
@@ -737,6 +795,7 @@ function isMemory(value: unknown): value is DurableMemory {
 		&& (m.suppressedHashes === undefined || (Array.isArray(m.suppressedHashes) && m.suppressedHashes.every((h) => typeof h === "string" && /^[a-f0-9]{24}$/u.test(h))))
 		&& typeof m.createdAt === "string" && typeof m.updatedAt === "string"
 		&& Number.isFinite(Date.parse(m.createdAt)) && Number.isFinite(Date.parse(m.updatedAt))
+		&& (m.reinforcedAt === undefined || (typeof m.reinforcedAt === "string" && Number.isFinite(Date.parse(m.reinforcedAt))))
 		&& Number.isInteger(m.revision) && m.revision > 0 && ["durable", "pinned"].includes(m.layer)
 		&& ["provisional", "confirmed", "forgotten", "conflicted"].includes(m.status);
 }

package/src/memory/quality.ts

@@ -56,26 +56,47 @@ export function mayReplace(old: DurableMemory, incoming: Evidence): boolean {
 }
 
 const DAY = 86400_000;
-/** No new expiry for stable facts/preferences/decisions and no revival of old states.
- * Floors preserve old useful knowledge; project states retain their seven-day safety cap. */
-export const AGING: Record<MemoryKind, { halfLifeDays: number; floor: number; expiresDays?: number }> = {
-	project_state: { halfLifeDays: 3, floor: 0.5, expiresDays: 7 },
-	fact: { halfLifeDays: 90, floor: 0.75 },
-	decision: { halfLifeDays: 180, floor: 0.85 },
-	preference: { halfLifeDays: 365, floor: 0.95 },
+/** Age is not evidence of falsity. A preference nobody has restated in a year is almost certainly
+ * still true, and a fact nobody has restated in three months might be false — age alone cannot tell
+ * them apart, so time never deletes anything here. Only contradicting evidence does, through
+ * `replaces`. What time does is stop a record being *offered*: past `dormantDays` it is no longer
+ * injected, while staying stored, recallable on request and eligible as a replacement candidate, so
+ * a source that mentions it again revives it with no human step. See `reinforcedAt`.
+ *
+ * The horizons are reasoned, not fitted - the store is far too young to fit them to. A statement
+ * about in-flight work is worthless after a week. An environment fact nobody has confirmed in half
+ * a year is unreliable. A decision unreferenced for a year has usually been overtaken by unrecorded
+ * practice. A preference is the most persistent thing a user tells us, so it gets two years.
+ *
+ * The floors were high because nothing could refresh a record: they had to protect knowledge that
+ * had no other way to stay fresh, which left decay inert (a preference could lose at most 5pp in
+ * its whole life). Reinforcement is that other way, so the floors come down and decay does real
+ * ranking work again. A floor is what a never-reconfirmed record still counts for at its horizon. */
+export const AGING: Record<MemoryKind, { halfLifeDays: number; floor: number; dormantDays: number }> = {
+	project_state: { halfLifeDays: 3, floor: 0.5, dormantDays: 7 },
+	fact: { halfLifeDays: 60, floor: 0.5, dormantDays: 180 },
+	decision: { halfLifeDays: 120, floor: 0.6, dormantDays: 365 },
+	preference: { halfLifeDays: 240, floor: 0.7, dormantDays: 730 },
 };
 export function memoryQuality(memory: DurableMemory, now = Date.now()) {
 	const policy = AGING[memory.kind];
-	const ageDays = Math.max(0, (now - Date.parse(memory.updatedAt)) / DAY);
+	// Decay runs from the last time the record was confirmed, not the last time it was edited.
+	// `updatedAt` remains the replacement authority gate and is never moved by confirmation.
+	const confirmed = Math.max(Date.parse(memory.updatedAt), Date.parse(memory.reinforcedAt ?? "") || 0);
+	const ageDays = Math.max(0, (now - confirmed) / DAY);
 	const pinned = memory.layer === "pinned";
 	const freshness = pinned ? 1 : policy.floor + (1 - policy.floor) * 2 ** (-ageDays / policy.halfLifeDays);
-	const expired = !pinned && policy.expiresDays !== undefined && ageDays > policy.expiresDays;
+	const dormant = !pinned && ageDays > policy.dormantDays;
+	// Shown to the model as a caution once a record is halfway to dormancy, relative to its own
+	// horizon rather than a fixed freshness number, which the floors would make meaningless.
+	const aging = !pinned && ageDays > policy.dormantDays / 2;
 	const basis = memory.evidence?.basis ?? "unknown";
 	const priority = evidencePriority(memory.kind, memory.evidence?.basis);
 	const evidenceWeight = 1 + priority * 0.04;
 	// Last explicit verdict wins, not frequency. Usefulness never increases evidence priority.
 	const utility = memory.feedback?.utility?.verdict === "useful" ? 1.05 : memory.feedback?.utility?.verdict === "unhelpful" ? 0.9 : 1;
 	const accuracy = memory.feedback?.accuracy?.verdict === "accurate" ? 1.05 : memory.feedback?.accuracy?.verdict === "incorrect" ? 0.5 : 1;
-	return { basis, method: memory.evidence?.method ?? "unknown", ageDays, freshness, expired,
+	return { basis, method: memory.evidence?.method ?? "unknown", ageDays, freshness, dormant, aging,
+		confirmedAt: new Date(confirmed).toISOString(),
 		evidenceWeight, utility, accuracy, factor: freshness * evidenceWeight * utility * accuracy };
 }

package/src/memory/retriever.ts

@@ -12,7 +12,7 @@ function overlap(text: string, query: Set<string>): number {
 
 /** Relevance scores are NOT confidence/truth scores. No authority bonus for cwd,
  * legacy labels, source IDs or dates. Metadata can only help an explicit origin query. */
-type RecallOptions = { includeExpiredProjectState?: boolean };
+type RecallOptions = { includeDormant?: boolean };
 type RankedMemory = { memory: DurableMemory; score: number; rankScore: number; quality: ReturnType<typeof memoryQuality>; coverage: number; matches: string[]; reason?: string };
 export interface RecallDiagnostics {
 	mode: string;
@@ -34,7 +34,7 @@ function evaluate(memories: readonly DurableMemory[], prompt: RecallInput, now:
 	const qualities = new Map(memories.map(m => [m.id, memoryQuality(m, now)]));
 	const excludedReason = (m: DurableMemory) => ["forgotten", "conflicted"].includes(m.status) ? m.status
 		: m.feedback?.accuracy?.verdict === "incorrect" ? "disputed"
-		: !options.includeExpiredProjectState && qualities.get(m.id)!.expired ? "expired-project-state" : undefined;
+		: !options.includeDormant && qualities.get(m.id)!.dormant ? "dormant" : undefined;
 	const active = memories.filter(m => !excludedReason(m));
 	const diagnostics: RecallDiagnostics = { mode: plan.mode, query: [...query].slice(0, 32), context: [...context].slice(0, 32),
 		eligible: active.length, excluded: memories.length - active.length, matched: 0, selected: [], candidates: [],