memleaf 0.2.34__tar.gz → 0.2.35__tar.gz

{memleaf-0.2.34 → memleaf-0.2.35}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to memleaf are documented here.
 
+## 0.2.35 — 2026-09-08
+
+- Add safe structural model-call telemetry across successful, deferred, and failed processing: call/retry/failure counts, model-request and stage wall-clock timing, input/output lengths, and maximum in-flight concurrency are retained without prompts, responses, memory bodies, credentials, provider secrets, URLs, or raw exception text.
+- Keep Gate admission serial, then allow bounded candidate-summary and final semantic-review concurrency only on explicitly parallel-safe model transports. `process.model_concurrency` defaults to 3 and is bounded to 1..8; host callbacks and caller-owned HTTP openers remain serial. Same-target UPDATE work stays ordered, target reconciliation happens before parallel work, and model calls never run while a Vault write lock is held.
+- Tighten semantic completeness so admitted memories preserve meaning-defining named subjects/entities, deliverables, concrete actions or states, required business/workstream context, and each number/code with its source-stated role. Final review now treats omission or over-generalization as a quality failure, preserves uncertainty, and must not invent owners, deadlines, statuses, completion meaning, or numeric roles.
+- Separate customer/project ownership from product/platform/system implementation context. Current-turn evidence remains authoritative for new relationships; existing memories are comparison context only and cannot create a new ownership or project-affiliation fact. Independent work remains source-neutrally split, while unresolved aggregate candidates defer instead of being silently discarded.
+- Validation for this release: deterministic regression, same-input synthetic serial-vs-parallel comparison, Linux Python 3.11/3.12/3.13, Windows Python 3.11/3.12/3.13, macOS Python 3.11/3.13, wheel/sdist, installed entry points, and native Codex Windows/macOS gates passed. One Windows Python 3.12 full-regression attempt had an isolated failure and its targeted rerun passed. Authorized real-model replay, production-conversation acceptance, and same-input real-provider latency comparison were not run, so this release does not claim a specific replacement for the previously observed 433-second session.
+
 ## 0.2.34 — 2026-09-08
 
 - Restrict automatic memory extraction to the current turn's visible user input and final assistant reply. Raw tool output, attachments, web/file/terminal payloads and legacy tool-evidence bodies are not new source evidence; existing or retrieved memory remains comparison context rather than source authority. Explicit memory-write prohibitions still fail closed.

{memleaf-0.2.34/src/memleaf.egg-info → memleaf-0.2.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memleaf
-Version: 0.2.34
+Version: 0.2.35
 Summary: A local-first Markdown memory core for AI agents
 Author: memleaf contributors
 License-Expression: MIT

memleaf-0.2.35/docs/processing-quality-acceptance.md

@@ -0,0 +1,73 @@
+# Processing performance and semantic-quality acceptance
+
+This document defines acceptance for automatic memory extraction without treating one validation layer as proof of another.
+
+## Invariants
+
+- Markdown under `knowledge/` remains the active-memory source of truth; `history/` remains historical state.
+- Gate stays serial. Model work must not run while a Vault write lock is held.
+- Candidate/review parallelism is bounded and opt-in through an explicitly parallel-safe backend. The default maximum is 3.
+- Same-target updates are coordinated before independent final reviews. Revision checks, idempotency and atomic commit remain authoritative.
+- Performance improvements must not remove Gate, summarization, reconciliation or semantic-review checks that are required for the same input.
+- Prompt/review rules are source-neutral. No mail-, calendar-, customer-, product- or other application-specific extraction rule is used.
+
+## Safe model telemetry
+
+`process()` returns `model_metrics`, and detached process-job results retain the same bounded projection. Metrics contain only structural numbers:
+
+- call count, retry count and failed-call count;
+- cumulative model-request duration and stage wall-clock duration;
+- input/output character and UTF-8 byte counts;
+- maximum in-flight model calls;
+- stage buckets for Gate, summarize, semantic review, coordination and target reconciliation.
+
+Prompts, responses, memory bodies, source text, credentials and provider secrets are not retained by these metrics. Existing optional diagnostic logging keeps its separate bounded structural contract.
+
+## Semantic acceptance contract
+
+A memory must remain understandable without reopening its source. For one admitted future-use topic, the summary/reviewer must preserve source-supported information that defines the item's meaning: the explicit subject or named entity, object/deliverable, concrete action or state, necessary business/workstream context, and any number or code together with its source-stated meaning when that meaning is required for interpretation.
+
+Minimality does not permit semantic generalization. A concrete requirement cannot become only “related matters” or an umbrella coordination item. Scope metadata is not a substitute for a named subject in the title/body when that subject distinguishes the item. A customer/project that owns an item and a broader product/platform in which it is implemented are separate relationships; one must not silently replace the other. Existing memories are comparison context and cannot supply a new ownership/project relationship. If attribution, a number's role, ownership, deadline or status is not established, preserve uncertainty or defer rather than guess.
+
+Independent deliverables that can be executed, tracked or closed independently remain independent memories. Same-turn aggregate reconciliation may merge only one future-use topic; otherwise the item remains deferred for reprocessing rather than being silently discarded as no change.
+
+## Acceptance layers
+
+### 1. Deterministic unit/regression tests
+
+Required checks include:
+
+- telemetry contains only allowlisted structural fields and counts retries correctly;
+- unsafe Host/callable routes remain serial; a parallel-safe API route respects `process.model_concurrency`;
+- final review concurrency preserves request/result ordering and does not mutate audit/Vault state from worker threads;
+- semantic-review contracts require both non-invention and preservation of meaning-defining facts;
+- existing negative-context, evidence-span, scope-operation/native-shadow, aggregate-splitting and Windows process-owner regressions continue to pass.
+
+Passing this layer proves only the deterministic contracts under test.
+
+### 2. Cross-platform CI and MCP/background-runtime verification
+
+Run the repository's supported OS matrix and the process-job/MCP tests. Verify that detached worker status exposes the bounded metrics, reruns aggregate metrics safely, and no model call is made while the Vault write lock is held.
+
+Passing this layer proves the tested runtime paths and platforms. It does not prove that a real model will always extract every business fact.
+
+### 3. Authorized real-model replay in an isolated Vault
+
+Use an explicitly authorized conversation and the same configured model/provider, but point the replay at an isolated temporary Vault. Record only the safe structural metrics plus the resulting test memories. Check at least:
+
+- omissions of subject/customer, concrete requirement, business context, and numeric meaning;
+- incorrect project/customer attribution or product-as-owner substitution;
+- incorrect todo state, owner, date or completion inference;
+- independent-item splitting and aggregate deferral/reprocessing;
+- duplicate/update behavior under repeated identical input;
+- sensitive-data boundaries and the configured external-provider authorization.
+
+For a before/after performance comparison, use the same captured input and equivalent model configuration. Compare model call count, retries, stage request-duration totals, stage wall-clock duration, maximum concurrency and final-memory quality. Do not claim a latency regression or improvement from different source input.
+
+### 4. Production conversation observation
+
+After release, compare one or more normal authorized production sessions against the same semantic checklist. Production observations are separate evidence from an isolated replay because model/service latency and real conversation structure can differ.
+
+## Delivery reporting
+
+Every delivery report must identify each layer as **passed**, **failed**, or **not run**. Never promote “unit tests passed” or “CI passed” into a claim that real-model semantic acceptance passed. If the real conversation content is not authorized for a particular external model/service, do not send it merely to complete acceptance; report that layer as not run.

{memleaf-0.2.34 → memleaf-0.2.35}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memleaf"
-version = "0.2.34"
+version = "0.2.35"
 description = "A local-first Markdown memory core for AI agents"
 readme = "README.md"
 requires-python = ">=3.11"

{memleaf-0.2.34 → memleaf-0.2.35}/src/memleaf/__init__.py

@@ -1,6 +1,6 @@
 """Local-first Markdown memory core for AI agents."""
 
-__version__ = "0.2.34"
+__version__ = "0.2.35"
 
 from .config import DEFAULT_CONFIG, default_config, load_config, save_config
 from .frontmatter import FrontmatterError, dump_frontmatter, dump_yaml, load_yaml, parse_frontmatter

{memleaf-0.2.34 → memleaf-0.2.35}/src/memleaf/config.py

@@ -16,6 +16,9 @@ from .scope_state import ScopeError, validate_scope_registry
 DEFAULT_REQUEST_TIMEOUT = 120
 MIN_REQUEST_TIMEOUT = 1
 MAX_REQUEST_TIMEOUT = 240
+DEFAULT_MODEL_CONCURRENCY = 3
+MIN_MODEL_CONCURRENCY = 1
+MAX_MODEL_CONCURRENCY = 8
 
 
 def _normalize_request_timeout(value: Any) -> int | float:
@@ -30,6 +33,14 @@ def _normalize_request_timeout(value: Any) -> int | float:
     return int(parsed) if parsed.is_integer() else parsed
 
 
+def _normalize_model_concurrency(value: Any) -> int:
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise ValueError("invalid memleaf process.model_concurrency")
+    if not MIN_MODEL_CONCURRENCY <= value <= MAX_MODEL_CONCURRENCY:
+        raise ValueError("invalid memleaf process.model_concurrency")
+    return value
+
+
 DEFAULT_CONFIG: dict[str, Any] = {
     "vault": "~/.memleaf",
     "agents": {"codex": True, "hermes": True, "antigravity": False},
@@ -40,6 +51,7 @@ DEFAULT_CONFIG: dict[str, Any] = {
         "memory_compact_candidate_ratio": 0.30,
         "inbox_cleanup_hours": 24,
         "closed_todo_retention_days": 30,
+        "model_concurrency": DEFAULT_MODEL_CONCURRENCY,
     },
     "history": {
         "policy": "bounded",
@@ -157,6 +169,11 @@ def load_config(path: Path | str, *, vault: Path | str | None = None) -> dict[st
     closed_todo_days = process.get("closed_todo_retention_days") if isinstance(process, Mapping) else None
     if type(closed_todo_days) is not int or closed_todo_days < 0:
         raise ValueError("invalid memleaf process.closed_todo_retention_days")
+    _normalize_model_concurrency(
+        process.get("model_concurrency", DEFAULT_MODEL_CONCURRENCY)
+        if isinstance(process, Mapping)
+        else DEFAULT_MODEL_CONCURRENCY
+    )
     history = merged.get("history")
     if not isinstance(history, Mapping):
         raise ValueError("invalid memleaf history settings")
@@ -199,6 +216,14 @@ def save_config(path: Path | str, config: Mapping[str, Any]) -> None:
         validate_native_sources(normalized.get("native_sources", {}), base_dir=Path(path).parent)
     except NativeConfigError as error:
         raise ValueError("invalid memleaf native_sources") from error
+    process = normalized.get("process")
+    if not isinstance(process, Mapping):
+        raise ValueError("invalid memleaf process settings")
+    normalized_process = dict(process)
+    normalized_process["model_concurrency"] = _normalize_model_concurrency(
+        normalized_process.get("model_concurrency", DEFAULT_MODEL_CONCURRENCY)
+    )
+    normalized["process"] = normalized_process
     llm = normalized.get("llm")
     if not isinstance(llm, Mapping):
         raise ValueError("invalid memleaf llm settings")

{memleaf-0.2.34 → memleaf-0.2.35}/src/memleaf/hermes_provider/plugin.yaml

@@ -1,5 +1,5 @@
 name: memleaf
-version: 0.2.34
+version: 0.2.35
 description: "Hermes-native external MemoryProvider for local-first Markdown memory shared with the memleaf MCP server."
 hooks:
   - prefetch

{memleaf-0.2.34 → memleaf-0.2.35}/src/memleaf/llm/base.py

@@ -142,6 +142,7 @@ class ModelUnavailable(ModelError):
 class ModelBackend(Protocol):
     provider: str
     model: str
+    parallel_safe: bool
 
     def complete(
         self,
@@ -158,6 +159,9 @@ class CallableBackend:
     """Adapt an explicitly injected host/test callback to ``ModelBackend``."""
 
     provider = "host"
+    # Host callbacks can close over arbitrary mutable state. Never assume a
+    # caller-owned callback is thread-safe merely because candidate work is.
+    parallel_safe = False
 
     def __init__(self, callback: Callable[..., str], *, model: str = "host"):
         if not callable(callback):
@@ -220,6 +224,7 @@ class HTTPModelBackend:
     """Common standard-library HTTP transport for compatible adapters."""
 
     provider = "api"
+    parallel_safe = False
 
     def __init__(
         self,
@@ -241,6 +246,9 @@ class HTTPModelBackend:
         self.model = model
         self.timeout = normalize_request_timeout(timeout)
         self._opener = opener or urllib.request.urlopen
+        # The built-in stateless urllib transport can be used concurrently.
+        # An injected opener is caller-owned and therefore defaults to serial.
+        self.parallel_safe = opener is None
 
     @staticmethod
     def _is_timeout_reason(value: Any) -> bool:

{memleaf-0.2.34 → memleaf-0.2.35}/src/memleaf/llm/router.py

@@ -52,6 +52,16 @@ class ModelRouter:
         mode = kwargs.pop("mode", llm_config.get("mode", "auto"))
         return cls(mode=mode, config=llm_config, **kwargs)
 
+    @property
+    def parallel_safe(self) -> bool:
+        """Expose concurrency only when routing cannot fall through a host callback."""
+
+        if self.mode == "api":
+            return getattr(self.api, "parallel_safe", False) is True
+        if self.mode == "auto" and self.host is None:
+            return getattr(self.api, "parallel_safe", False) is True
+        return False
+
     @staticmethod
     def _coerce_host(value: Any) -> Optional[ModelBackend]:
         if value is None:

{memleaf-0.2.34 → memleaf-0.2.35}/src/memleaf/memory_planner.py

@@ -14,6 +14,7 @@ from .create_coordinator import CreateCoordinator
 from .update_coordinator import UpdateCoordinator
 from .target_reconciliation import reconcile_candidate_target
 from .evidence_policy import retain_tool_evidence
+from .parallel_model import run_ordered_keyed_jobs
 from .prompts import COVERAGE_ALREADY_COMPLETED_CORRECTION, COVERAGE_CORRECTION, GATE_SYSTEM, SUMMARIZE_SYSTEM, gate_prompt, summarize_prompt
 from .retrieval import normalize_term
 from .scope_state import ScopeError, normalize_scopes
@@ -1008,6 +1009,18 @@ class MemoryPlanner:
         seen_candidates: set[tuple[Any, ...]] = set()
         seen_duplicate_targets: set[str] = set()
         admitted_candidates: dict[str, dict[str, Any]] = {}
+        summary_jobs: list[dict[str, Any]] = []
+        request_slots: list[dict[str, Any]] = []
+
+        def observe_scopes(values: Iterable[Any]) -> None:
+            for observed_scope in values:
+                if (
+                    isinstance(observed_scope, str)
+                    and observed_scope != "unscoped"
+                    and observed_scope not in observed_scopes
+                ):
+                    observed_scopes.append(observed_scope)
+
         for candidate in gate["candidates"]:
             candidate = dict(candidate)
             duplicate_target = candidate.get("duplicate_memory_id")
@@ -1266,18 +1279,17 @@ class MemoryPlanner:
                         )
                         continue
             if correction_plan is not None and correction_plan.get("survivor_memory_id"):
-                requests.append(
-                    self.inputs._scope_correction_request(
+                request_slots.append({
+                    "kind": "request",
+                    "request": self.inputs._scope_correction_request(
                         candidate,
                         turn,
                         correction_plan,
                         conversation_title=title,
                         native_refs=candidate_native_refs,
-                    )
-                )
-                for observed_scope in candidate.get("scopes", []):
-                    if isinstance(observed_scope, str) and observed_scope != "unscoped" and observed_scope not in observed_scopes:
-                        observed_scopes.append(observed_scope)
+                    ),
+                    "scopes": list(candidate.get("scopes", [])),
+                })
                 continue
             candidate_native_ids = [item["native_id"] for item in candidate_native_refs]
             all_candidate_memory_ids: list[str] = []
@@ -1335,13 +1347,7 @@ class MemoryPlanner:
                         ),
                         [],
                     )
-                    for observed_scope in duplicate_scopes:
-                        if (
-                            isinstance(observed_scope, str)
-                            and observed_scope != "unscoped"
-                            and observed_scope not in observed_scopes
-                        ):
-                            observed_scopes.append(observed_scope)
+                    request_slots.append({"kind": "observe", "scopes": list(duplicate_scopes)})
                     self.audit._record_disposition(
                         turn_ref,
                         candidate,
@@ -1378,75 +1384,160 @@ class MemoryPlanner:
             admitted_summary_keys = tuple(dict.fromkeys(event["event_key"] for event in admitted_summary_events))
             grounded_summary_dates = _grounded_due_dates(turn, evidence_events=admitted_summary_events)
             summary_target = self.inputs._active_memory_by_id(gate_update_target) if gate_update_target else None
-            try:
-                def parse_summary(raw: str) -> dict[str, Any]:
-                    parsed = parse_summarize_output(
-                        _normalize_summary_dates(raw, turn, candidate),
-                        current_event_keys=admitted_summary_keys,
-                        related_native_ids=candidate_native_ids,
-                        related_memory_ids=same_type_update_memory_ids,
-                        scope_registry=validation_scope_registry,
-                        expected_scopes=candidate["scopes"],
-                        expected_scope_source=candidate["scope_source"],
-                        allowed_due_dates=grounded_summary_dates,
-                        allow_no_change=True,
-                        # The summarize stage may not reinterpret a gate
-                        # candidate, including CREATE candidates. Updates
-                        # additionally retain the active target's immutable
-                        # type below.
-                        expected_type=candidate.get("type"),
-                        allow_update_target=gate_update_target is not None,
-                        expected_update_memory_id=gate_update_target,
-                        expected_target_type=gate_target_type,
-                    )
-                    if _summary_date_grounding_violations(
-                        parsed,
-                        grounded_dates=grounded_summary_dates,
-                        source_texts=[event.get("content", "") for event in admitted_summary_events if event.get("role") in {"user", "assistant"}],
-                        preserved_texts=(summary_target.title, summary_target.body, summary_target.due_date) if summary_target else (),
-                    ):
-                        raise ModelOutputError("summary contains a date absent from its admitted evidence", validation_detail="relative_time")
-                    return parsed
-
-                target_revisions = {}
-                for related_item in candidate_related:
-                    if isinstance(related_item.get("memory_id"), str):
-                        target_memory = self.inputs._active_memory_by_id(related_item["memory_id"])
-                        if target_memory is not None:
-                            target_revisions[target_memory.memory_id] = revision_digest(target_memory)
-                summary_candidate = dict(candidate)
-                model_candidate_id = summary_candidate.pop("_model_candidate_id", None)
-                if isinstance(model_candidate_id, str) and model_candidate_id:
-                    summary_candidate["candidate_id"] = model_candidate_id
-                summary = self.model._complete_json_stage(
-                    backend,
-                    summarize_prompt(
-                        summary_candidate,
-                        admitted_summary_events,
-                        related_memories=candidate_related,
-                        scope_background=candidate_scope_background,
-                        scope_registry=scope_registry,
-                    ),
-                    system=SUMMARIZE_SYSTEM,
-                    purpose="summarize",
-                    parser=parse_summary,
-                    diagnostic_context={
-                        "source": turn.source,
-                        "session_id": turn.session_id,
-                        "turn_index": turn.turn_index,
-                    },
+
+            def parse_summary(
+                raw: str,
+                *,
+                candidate_value: Mapping[str, Any] = candidate,
+                admitted_keys_value: tuple[str, ...] = admitted_summary_keys,
+                native_ids_value: list[str] = candidate_native_ids,
+                update_ids_value: list[str] = same_type_update_memory_ids,
+                grounded_dates_value: set[str] = grounded_summary_dates,
+                admitted_events_value: list[dict[str, Any]] = admitted_summary_events,
+                summary_target_value: Any = summary_target,
+                gate_update_target_value: Any = gate_update_target,
+                gate_target_type_value: Any = gate_target_type,
+            ) -> dict[str, Any]:
+                parsed = parse_summarize_output(
+                    _normalize_summary_dates(raw, turn, candidate_value),
+                    current_event_keys=admitted_keys_value,
+                    related_native_ids=native_ids_value,
+                    related_memory_ids=update_ids_value,
+                    scope_registry=validation_scope_registry,
+                    expected_scopes=candidate_value["scopes"],
+                    expected_scope_source=candidate_value["scope_source"],
+                    allowed_due_dates=grounded_dates_value,
+                    allow_no_change=True,
+                    # The summarize stage may not reinterpret a gate
+                    # candidate, including CREATE candidates. Updates
+                    # additionally retain the active target's immutable
+                    # type below.
+                    expected_type=candidate_value.get("type"),
+                    allow_update_target=gate_update_target_value is not None,
+                    expected_update_memory_id=gate_update_target_value,
+                    expected_target_type=gate_target_type_value,
                 )
-            except ModelOutputError as error:
-                if getattr(error, "validation_detail", None) not in {
-                    "relative_time",
-                    "due_date_not_grounded",
-                }:
-                    raise
+                if _summary_date_grounding_violations(
+                    parsed,
+                    grounded_dates=grounded_dates_value,
+                    source_texts=[
+                        event.get("content", "")
+                        for event in admitted_events_value
+                        if event.get("role") in {"user", "assistant"}
+                    ],
+                    preserved_texts=(
+                        summary_target_value.title,
+                        summary_target_value.body,
+                        summary_target_value.due_date,
+                    ) if summary_target_value else (),
+                ):
+                    raise ModelOutputError(
+                        "summary contains a date absent from its admitted evidence",
+                        validation_detail="relative_time",
+                    )
+                return parsed
+
+            target_revisions = {}
+            for related_item in candidate_related:
+                if isinstance(related_item.get("memory_id"), str):
+                    target_memory = self.inputs._active_memory_by_id(related_item["memory_id"])
+                    if target_memory is not None:
+                        target_revisions[target_memory.memory_id] = revision_digest(target_memory)
+            summary_candidate = dict(candidate)
+            model_candidate_id = summary_candidate.pop("_model_candidate_id", None)
+            if isinstance(model_candidate_id, str) and model_candidate_id:
+                summary_candidate["candidate_id"] = model_candidate_id
+            summary_prompt_value = summarize_prompt(
+                summary_candidate,
+                admitted_summary_events,
+                related_memories=candidate_related,
+                scope_background=candidate_scope_background,
+                scope_registry=scope_registry,
+            )
+            diagnostic_context = {
+                "source": turn.source,
+                "session_id": turn.session_id,
+                "turn_index": turn.turn_index,
+            }
+
+            def run_summary(
+                *,
+                prompt_value: str = summary_prompt_value,
+                parser_value: Any = parse_summary,
+                diagnostic_value: Mapping[str, Any] = diagnostic_context,
+            ) -> dict[str, Any]:
+                try:
+                    return {
+                        "status": "ok",
+                        "summary": self.model._complete_json_stage(
+                            backend,
+                            prompt_value,
+                            system=SUMMARIZE_SYSTEM,
+                            purpose="summarize",
+                            parser=parser_value,
+                            diagnostic_context=diagnostic_value,
+                        ),
+                    }
+                except ModelOutputError as error:
+                    if getattr(error, "validation_detail", None) not in {
+                        "relative_time",
+                        "due_date_not_grounded",
+                    }:
+                        raise
+                    return {"status": "relative_time"}
+
+            target_key = (
+                f"update:{gate_update_target.casefold()}"
+                if isinstance(gate_update_target, str) and gate_update_target
+                else f"create:{str(candidate['candidate_id']).casefold()}"
+            )
+            job_index = len(summary_jobs)
+            summary_jobs.append({
+                "key": target_key,
+                "call": run_summary,
+                "candidate": dict(candidate),
+                "candidate_related": candidate_related,
+                "candidate_native_refs": candidate_native_refs,
+                "correction_plan": correction_plan,
+                "gate_update_target": gate_update_target,
+                "target_revisions": target_revisions,
+            })
+            request_slots.append({"kind": "summary", "job_index": job_index})
+
+        summary_outcomes = run_ordered_keyed_jobs(
+            self.model,
+            backend,
+            [(job["key"], job["call"]) for job in summary_jobs],
+        )
+
+        for slot in request_slots:
+            kind = slot.get("kind")
+            if kind == "observe":
+                observe_scopes(slot.get("scopes", []))
+                continue
+            if kind == "request":
+                request = slot.get("request")
+                if isinstance(request, dict):
+                    requests.append(request)
+                observe_scopes(slot.get("scopes", []))
+                continue
+            if kind != "summary":
+                continue
+            job_index = slot.get("job_index")
+            if not isinstance(job_index, int) or isinstance(job_index, bool):
+                raise ProcessingError("invalid prepared summary job")
+            job = summary_jobs[job_index]
+            outcome = summary_outcomes[job_index]
+            candidate = job["candidate"]
+            candidate_related = job["candidate_related"]
+            candidate_native_refs = job["candidate_native_refs"]
+            correction_plan = job["correction_plan"]
+            gate_update_target = job["gate_update_target"]
+            target_revisions = job["target_revisions"]
+            if outcome.get("status") == "relative_time":
                 # The candidate's source turn remains in inbox for an
-                # explicit retry.  Other candidates from this same turn may
-                # still commit safely in the same transaction.  The existing
-                # relative_time audit reason covers both unresolved relative
-                # text and an ungrounded explicit due_date.
+                # explicit retry. Other candidates from this same turn may
+                # still commit safely in the same transaction.
                 self.audit._defer_candidate(
                     turn_ref,
                     candidate,
@@ -1454,6 +1545,10 @@ class MemoryPlanner:
                     scopes=candidate["scopes"],
                 )
                 continue
+            summary = outcome.get("summary")
+            if not isinstance(summary, Mapping):
+                raise ProcessingError("invalid prepared summary result")
+            summary = dict(summary)
             if summary.get("decision") == NO_CHANGE_DECISION:
                 self.audit._record_disposition(
                     turn_ref,
@@ -1470,7 +1565,6 @@ class MemoryPlanner:
             if gate_update_target is not None:
                 summary_update_target = summary.get("update_memory_id")
                 if summary_update_target is None:
-                    summary = dict(summary)
                     summary["update_memory_id"] = gate_update_target
                 elif (
                     not isinstance(summary_update_target, str)
@@ -1481,12 +1575,10 @@ class MemoryPlanner:
                         validation_detail="invalid_update_target",
                     )
                 else:
-                    summary = dict(summary)
                     summary["update_memory_id"] = gate_update_target
-                target = self.service.read(gate_update_target, include_history=False)
+                self.service.read(gate_update_target, include_history=False)
                 # The summary is the complete model-proposed current value.
                 # Do not concatenate old/new bodies using business keywords.
-                pass
             if summary["scopes"] == ["unscoped"] or summary.get("scope_source") == "insufficient_context":
                 self.audit._defer_candidate(
                     turn_ref,
@@ -1547,13 +1639,8 @@ class MemoryPlanner:
                     else pending_request["memory_id"]
                 ),
             )
-            for observed_scope in summary["scopes"]:
-                if (
-                    isinstance(observed_scope, str)
-                    and observed_scope != "unscoped"
-                    and observed_scope not in observed_scopes
-                ):
-                    observed_scopes.append(observed_scope)
+            observe_scopes(summary["scopes"])
+
         requests = CreateCoordinator(self.model, self.audit).resolve(
             requests, candidates=admitted_candidates, evidence_units=planning_evidence_units, events=events,
             backend=backend, scope_registry=scope_registry, validation_scope_registry=validation_scope_registry)