memleaf 0.2.46__tar.gz → 0.2.48__tar.gz

{memleaf-0.2.46 → memleaf-0.2.48}/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to memleaf are documented here.
 
+## 0.2.48 — 2026-09-13
+
+- Restore same-target reconciliation in the B3 single-pass path. A real turn was discarded with `B3 target referenced more than once` whenever the model admitted two changes for one existing memory. One memory can only receive one terminal disposition per turn, because the writer archives the previous version and overwrites the same file, so the colliding items are now reconciled with one bounded call into a single current state and an unresolvable group is deferred as `target_ambiguous` instead of guessed. This is the capability the legacy staged path already had; it is not a new retry class, and the compact contract now tells the model to merge such changes into one UPDATE in the first place. The call is charged against the same two-request turn budget as the primary extraction and its structural repair, so a collision can never lengthen a turn: when a repair has already spent the budget, the group defers and every other item still commits. The strict "a target may be used once" rejection remains in the parser for direct callers.
+- Give the B3 planner the temporal anchor it was always assumed to have. The prompt contract promised that "an admitted visible-message timestamp may anchor a supported relative date" and Core grounded `due_date` against exactly that timestamp, but the evidence projection never showed it to the model. A yearless deadline such as "9 月 30 号" was therefore unanswerable: the model guessed a year, and the grounded-date gate correctly rejected the entire turn. Each projected evidence unit now carries its own event timestamp, a `DATES` section states that the anchor resolves only dates the unit's own text expresses, and a timestamp's own date is never content.
+- Stop treating a reworded yearless date as an invented one. Grounding compared raw surface text, so a faithful restatement of a source date that only changed its suffix, such as 号 -> 日, was rejected as ungrounded and cost the whole turn. A yearless date is now recognised by its month and day, which is the property the guard actually protects: no year is ever inferred, and a different month, day or full date is still refused.
+- State that `status`, `completed_at` and `due_date` are todo-only in the compact contract. The validator has always rejected a `status` on any other type, but the model was never told, so a correct-looking extraction failed with `invalid todo status`; the contract now also states that a todo UPDATE restates its status and that `completed` and `completed_at` require each other.
+- Resolve one bookkeeping contradiction instead of discarding the turn. A unit listed both as an item's evidence and as `no_memory` is self-contradictory, and the resolution is forced: an item already bound the unit, so the unit is not a no-memory unit. The redundant row is dropped, counted as `b3_normalization_count`, and no memory content, scope or evidence binding changes. Genuine omissions still fail closed as incomplete evidence coverage.
+- Stop the single-pass budget wrapper from erasing protocol capability. `SinglePassBudgetBackend` delegates by attribute name, and `ModelRouter` had gained `single_pass_safe` without `single_pass_protocol`, so a wrapped route that does speak `b3-single-pass-v1` read as incapable and every automatic turn failed in 0.000s with zero model calls. The router now answers both properties from the same resolved route.
+- Keep a clipped native memory from making the lookup look incomplete. Native sources are comparison context and can never be an UPDATE or NO_CHANGE target, but a native body shortened for the prompt budget was recorded as a dropped item and marked `lookup_complete=false`, which blocked every terminal decision in the turn. Only an item that is actually discarded for the budget can affect completeness now, and the prompt-length budget itself is unchanged.
+
+Verification for this release combined focused synthetic tests with one real-model replay. 84 tests pass with no model call, covering same-target reconciliation (merge, no-change, deferral, re-validation, evidence union, and a route-level assertion that a third provider request is never issued), the date anchor projection, yearless-date identity, the todo-field contract, redundant-row normalization, the wrapper capability properties and native clipping completeness. The real replay ran the previously failing production session against `deepseek-flash`: before these fixes every attempt failed in the planner, and after them five consecutive preview runs completed with `execution_status: ok` (four `coverage_status: complete`, one partial with a single deferred candidate), and the committed run wrote five memories into the live Vault with a todo carrying `status: active` and the correct grounded `due_date`. A single-candidate semantic rejection from the model still fails its turn closed; restoring per-candidate deferral or semantic retries for that case would be a deliberate design change and was not made here.
+
+## 0.2.47 — 2026-09-12
+
+- Fix two satisfiability deadlocks in the public candidate filter that made every compound query carrying a punctuation-rich identifier return no_match. Word splitting turns `vX.Y.Z` into `vX` / `Y` / `Z`; those one-character fragments were collected as *required* ASCII components while the matching rule refused to treat anything shorter than three characters as a strong match, so the requirement could never be met. A fixed three-character bar had the same effect on a two-character CJK component whenever an ASCII component was present. A component that cannot reach its own bar no longer creates a requirement, and a CJK component's bar never exceeds its own length. Identifier strictness is unchanged: a short fragment still cannot stand in for a longer topic.
+- State the `sources` entry shape in the summarize contract instead of leaving the model to infer it, and generate that sentence from the validator's own field list so the instruction and the enforced shape cannot drift apart. Production `remember` calls writing a todo failed four times with `schema_violation` / `source_shape`: the prompt required `sources` and mentioned event keys but never described the object the validator accepts. A bare admitted event key is now additionally normalized to `{"event_key": ...}` losslessly, and `source_shape` gained a targeted repair instruction so the bounded retry corrects the shape instead of re-deriving the whole summary.
+- Make failed automatic extraction visible. `_state/processed.json` already recorded which sessions failed, at which stage and with which code, but nothing surfaced it: a Vault whose every turn failed extraction still looked idle from outside. `process_status` now accepts an omitted `job_id` and reports Vault-level extraction health — failed and running sessions, failure code and stage, and retryable turn counts. The report is strictly read-only and opens the Vault without creating it.
+- Report an incompatible model route instead of a misleading `ready`. The installer answered `processing_status: ready` for any configured route, including one whose adapter cannot speak the single-pass protocol. `install --host hermes` now distinguishes `ready`, `model_route_required` and `model_route_incompatible`. Capability is resolved through the same `ModelRouter` the extraction path uses, so the adapter decides and no rule is restated; no request is sent and no service is probed.
+- Document that the Claude and Gemini adapters implement no verified structured-output boundary, so the single-pass protocol stays fail-closed for them by design: a Vault routed through `llm.protocol: claude` cannot run automatic extraction, while capture, retrieval and explicit `remember`/`forget` are unaffected. Automatic extraction therefore requires an OpenAI-compatible route. No tool was added, removed or renamed; the public MCP surface remains the same 13 tools.
+
+Verification for this release used synthetic memories, temporary Vaults, synthetic routes and no model call: 51 focused tests cover the retrieval deadlocks and the strictness they preserve, the `sources` contract and its consistency with the validator, the targeted repair selection, the route capability decision across Claude, OpenAI/DeepSeek and unknown OpenAI-compatible routes, and the read-only processing-health report. Real-model first-pass success rate, repair success rate, reasoning reduction and latency improvement remain unmeasured, and the two reported production sessions were not replayed.
+
 ## 0.2.46 — 2026-09-12
 
 - Restore the host protocol literals that v0.2.45 dropped from the API-route protocol table. `anthropic_messages`, `chat_completions`, `chat`, `google` and `generate_content` resolve again. v0.2.45 replaced the previous tolerant mapping with an exact table that omitted every canonical Hermes `api_mode` value, so a Hermes custom provider that used to resolve to a protocol began resolving to none and was reported as `missing provider, base URL, protocol, or model`. Substring and model-name matching stay removed: only exact host-contract literals are accepted, and an unknown protocol still fails closed.

{memleaf-0.2.46/src/memleaf.egg-info → memleaf-0.2.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memleaf
-Version: 0.2.46
+Version: 0.2.48
 Summary: A local-first Markdown memory core for AI agents
 Author: memleaf contributors
 License-Expression: MIT
@@ -23,7 +23,7 @@ Dynamic: license-file
 
 [English](README.en.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **版本：0.2.46。**
+> **版本：0.2.48。**
 > 记忆只从用户与 Agent 的可见对话提炼。Agent 已在回复中整理的事实、项目进展和明确待办可作为来源；邮件、附件、网页和终端等工具原文不进入记忆提炼。模型负责保留原话中的不确定性，现有记忆仅用于比较、去重和更新。Markdown 仍是唯一事实源。
 > **当前版本支持 Hermes 和 Codex。** Antigravity（反重力）不检测、不安装、不配置。
 

{memleaf-0.2.46 → memleaf-0.2.48}/README.en.md

@@ -4,7 +4,7 @@
 
 [中文](README.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **Version: 0.2.46.**
+> **Version: 0.2.48.**
 > Automatic extraction now uses only the current turn's visible user input and final assistant reply. Raw tool output, attachments, web/file/terminal payloads and legacy tool-evidence bodies are not new source evidence; existing or retrieved memory remains comparison context rather than source authority. Background processing is persisted as a local job and can be checked through the read-only `process_status` MCP tool; failed work remains retryable and fail closed. The release also tightens source/date grounding, target reconciliation, duplicate/no-op handling and semantic review before writes. Markdown remains the sole source of truth with no SQLite runtime dependency. Acceptance covers deterministic regression suites and synthetic inputs; it does not claim real-mail or customer-business acceptance.
 > **The current release supports Hermes and Codex.** Antigravity is not detected, installed, or configured.
 

{memleaf-0.2.46 → memleaf-0.2.48}/README.md

@@ -4,7 +4,7 @@
 
 [English](README.en.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **版本：0.2.46。**
+> **版本：0.2.48。**
 > 记忆只从用户与 Agent 的可见对话提炼。Agent 已在回复中整理的事实、项目进展和明确待办可作为来源；邮件、附件、网页和终端等工具原文不进入记忆提炼。模型负责保留原话中的不确定性，现有记忆仅用于比较、去重和更新。Markdown 仍是唯一事实源。
 > **当前版本支持 Hermes 和 Codex。** Antigravity（反重力）不检测、不安装、不配置。
 

{memleaf-0.2.46 → memleaf-0.2.48}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memleaf"
-version = "0.2.46"
+version = "0.2.48"
 description = "A local-first Markdown memory core for AI agents"
 readme = "README.md"
 requires-python = ">=3.11"

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/__init__.py

@@ -1,6 +1,6 @@
 """Local-first Markdown memory core for AI agents."""
 
-__version__ = "0.2.46"
+__version__ = "0.2.48"
 
 from .config import DEFAULT_CONFIG, default_config, load_config, save_config
 from .frontmatter import FrontmatterError, dump_frontmatter, dump_yaml, load_yaml, parse_frontmatter

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/cli.py

@@ -312,12 +312,17 @@ def main(argv: Sequence[str] | None = None) -> int:
                 print("Restart Hermes to use memleaf.")
             elif output.get("user_action_required"):
                 print(f"Codex action required: {output.get('user_action')}")
-            if output.get("processing_status") == "model_route_required":
+            processing = output.get("processing_status")
+            if processing == "model_route_required":
                 print(
                     "Automatic memory extraction needs a memleaf model route before it can run. "
                     "Set llm.provider/family/protocol/base_url/model/key in the Vault config.yaml, "
                     "or rerun `memleaf init` from an interactive terminal."
                 )
+            elif processing == "model_route_incompatible":
+                print("Automatic memory extraction cannot run on this route.")
+                if output.get("user_action"):
+                    print(f"  {output['user_action']}")
         else:
             _print_install_failure(output, host=args.host)
         return 0 if output.get("status") in {"configured", "already_configured"} else 2

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/extraction_budget.py

@@ -24,6 +24,9 @@ class SinglePassBudgetBackend:
     hidden host-to-API fallback. The optional durable reservation preserves
     consumed attempts across worker restarts. Neither the first request nor
     its repair overrides the transport's configured ``llm.request_timeout``.
+    The second request is spent on whichever bounded follow-up the planner
+    actually needs -- a structural repair or a same-target reconciliation --
+    so a collision between two admitted items can never extend the turn.
     """
 
     def __init__(

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/hermes_provider/plugin.yaml

@@ -1,5 +1,5 @@
 name: memleaf
-version: 0.2.46
+version: 0.2.48
 description: "Hermes-native external MemoryProvider for local-first Markdown memory shared with the memleaf MCP server."
 hooks:
   - prefetch

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/installer.py

@@ -754,7 +754,46 @@ def _failure_result(
     return result
 
 
-def _model_route_outcome(model: Any) -> tuple[bool, str, str | None]:
+_MODEL_ROUTE_REQUIRED_ACTION = (
+    "Configure an independent memleaf Model Route for this Vault before relying on "
+    "automatic memory extraction. Host model/provider settings are intentionally "
+    "not used or modified."
+)
+
+_MODEL_ROUTE_INCOMPATIBLE_ACTION = (
+    "This Vault's model route cannot run automatic memory extraction. The Claude and "
+    "Gemini adapters implement no verified structured-output boundary, so the "
+    "single-pass protocol stays fail-closed for them; v0.2.x automatic extraction "
+    "requires an OpenAI-compatible route (set llm.protocol to openai). Capture, "
+    "retrieval, and explicit remember/forget keep working unchanged."
+)
+
+
+def _route_can_extract(vault: Any) -> bool:
+    """Ask the production router whether this Vault's route can speak B3.
+
+    This deliberately reuses the same decision the extraction path makes instead
+    of restating the capability rules: the installer must never advertise
+    ``ready`` for a route whose adapter leaves ``single_pass_protocol`` False.
+    No request is sent and no service is probed.
+    """
+
+    try:
+        from .extraction_capability import supports_single_pass_protocol
+        from .llm import ModelRouter
+
+        router = ModelRouter.from_config(vault.config())
+    except Exception:
+        return False
+    try:
+        return bool(supports_single_pass_protocol(router))
+    except Exception:
+        return False
+
+
+def _model_route_outcome(
+    model: Any, *, can_extract: bool | None = None
+) -> tuple[bool, str, str | None]:
     """Decide how one host installation reports its model route.
 
     A missing model route must never block installing the host integration.
@@ -763,17 +802,17 @@ def _model_route_outcome(model: Any) -> tuple[bool, str, str | None]:
     route is configured.  This is the documented Codex policy, and applying it
     to Hermes keeps the two hosts consistent instead of aborting the install
     and leaving core and provider versions out of step.
+
+    ``can_extract`` carries the resolved capability of a *configured* route.  A
+    route can be present and still be unable to run automatic extraction, so
+    reporting plain ``ready`` for it would be a false promise.
     """
 
-    if isinstance(model, Mapping) and model.get("status") in {"configured", "already_configured"}:
-        return True, "ready", None
-    return (
-        False,
-        "model_route_required",
-        "Configure an independent memleaf Model Route for this Vault before relying on "
-        "automatic memory extraction. Host model/provider settings are intentionally "
-        "not used or modified.",
-    )
+    if not (isinstance(model, Mapping) and model.get("status") in {"configured", "already_configured"}):
+        return False, "model_route_required", _MODEL_ROUTE_REQUIRED_ACTION
+    if can_extract is False:
+        return False, "model_route_incompatible", _MODEL_ROUTE_INCOMPATIBLE_ACTION
+    return True, "ready", None
 
 
 def install_hermes(
@@ -897,8 +936,12 @@ def install_hermes(
     )
     # A missing route degrades the installation instead of aborting it: the
     # Hermes provider and MCP surface do not need a model route, and stopping
-    # here used to leave core and provider versions out of step.
-    model_ready, processing_status, model_action = _model_route_outcome(model)
+    # here used to leave core and provider versions out of step.  A *present*
+    # route that cannot speak B3 is reported separately, because advertising
+    # ``ready`` for it would promise extraction that can never run.
+    model_ready, processing_status, model_action = _model_route_outcome(
+        model, can_extract=_route_can_extract(vault)
+    )
     # ``model_ready`` is reported through ``processing_status`` below; the host
     # integration itself is configured either way.
 

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/llm/router.py

@@ -84,6 +84,22 @@ class ModelRouter:
             return getattr(self.api, "single_pass_safe", False) is True
         return False
 
+    @property
+    def single_pass_protocol(self) -> bool:
+        """Expose B3 protocol capability symmetrically with ``single_pass_safe``.
+
+        Request-budget wrappers forward capability by attribute name.  A router
+        that exposed only ``single_pass_safe`` therefore read as protocol
+        incapable the moment it was wrapped, which made automatic extraction
+        fail on exactly the routes that were safe enough to be wrapped.
+        """
+
+        if self.mode == "api":
+            return getattr(self.api, "single_pass_protocol", False) is True
+        if self.mode == "auto" and self.host is None:
+            return getattr(self.api, "single_pass_protocol", False) is True
+        return False
+
     @staticmethod
     def _coerce_host(value: Any) -> Optional[ModelBackend]:
         if value is None:

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/mcp_server.py

@@ -286,8 +286,14 @@ _TOOLS: tuple[dict[str, Any], ...] = (
     },
     {
         "name": "process_status",
-        "description": "Read the status of an accepted background process job.",
-        "inputSchema": _object_schema({"job_id": {"type": "string"}}, required=["job_id"]),
+        "description": (
+            "Read the status of an accepted background process job, or, when job_id is "
+            "omitted, the Vault's automatic-extraction health: failed and running "
+            "sessions, the failure code and stage, and whether the work is still "
+            "retryable. Failed extraction is never silent; check this when expected "
+            "memories do not appear."
+        ),
+        "inputSchema": _object_schema({"job_id": {"type": "string"}}),
     },
     {
         "name": "remember",
@@ -930,9 +936,15 @@ def _invoke_tool(
                 else:
                     value = service.process(**args)
         elif name == "process_status":
-            from .process_jobs import status
+            job_id = args.get("job_id")
+            if isinstance(job_id, str) and job_id:
+                from .process_jobs import status
+
+                value = status(service.vault.root, job_id=job_id)
+            else:
+                from .process_journal import processing_health
 
-            value = status(service.vault.root, job_id=args.get("job_id", ""))
+                value = processing_health(service.vault.root)
         elif name == "remember":
             value = service.remember(**args)
         elif name == "forget_memory":

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/model_execution.py

@@ -9,7 +9,7 @@ from typing import Any, Callable, Mapping, Optional
 from .config import DEFAULT_MODEL_CONCURRENCY, MAX_MODEL_CONCURRENCY, MIN_MODEL_CONCURRENCY
 from .llm import MODEL_VALIDATION_REASONS, CallableBackend, ModelError, ModelUnavailable, ModelRouter
 from .models import utc_now
-from .prompts import COVERAGE_ALREADY_COMPLETED_CORRECTION, COVERAGE_CANDIDATE_CORRECTION, COVERAGE_CORRECTION, COVERAGE_SHAPE_CORRECTION, DUPLICATE_TARGET_CORRECTION, EVIDENCE_EVENT_MAPPING_CORRECTION, EVIDENCE_SPAN_CORRECTION, GATE_STRUCTURE_REPAIR_SYSTEM, GATE_TYPE_CORRECTION, JSON_CORRECTION, MIXED_FUTURE_USE_CORRECTION, MIXED_PROJECT_SCOPES_CORRECTION, RELATIVE_TIME_CORRECTION, SCOPE_GROUNDING_CORRECTION, SUMMARY_SCOPE_CORRECTION, SUMMARY_TARGET_CORRECTION, SUMMARY_TYPE_CORRECTION, TARGET_RELEVANCE_CORRECTION, UPDATE_TARGET_TYPE_CORRECTION, gate_structure_repair_prompt
+from .prompts import COVERAGE_ALREADY_COMPLETED_CORRECTION, COVERAGE_CANDIDATE_CORRECTION, COVERAGE_CORRECTION, COVERAGE_SHAPE_CORRECTION, DUPLICATE_TARGET_CORRECTION, EVIDENCE_EVENT_MAPPING_CORRECTION, EVIDENCE_SPAN_CORRECTION, GATE_STRUCTURE_REPAIR_SYSTEM, GATE_TYPE_CORRECTION, JSON_CORRECTION, MIXED_FUTURE_USE_CORRECTION, MIXED_PROJECT_SCOPES_CORRECTION, RELATIVE_TIME_CORRECTION, SCOPE_GROUNDING_CORRECTION, SOURCES_SHAPE_CORRECTION, SUMMARY_SCOPE_CORRECTION, SUMMARY_TARGET_CORRECTION, SUMMARY_TYPE_CORRECTION, TARGET_RELEVANCE_CORRECTION, UPDATE_TARGET_TYPE_CORRECTION, gate_structure_repair_prompt
 from .validation import MODEL_VALIDATION_DETAILS, ModelOutputError, parse_strict_json
 from .process_common import _DIAGNOSTIC_FILENAME, _DIAGNOSTIC_MAX_BYTES, _failure_metadata, _model_output_statistics, _safe_evidence_check, _safe_evidence_diagnostics
 
@@ -686,6 +686,8 @@ class ModelExecutor:
                 return COVERAGE_ALREADY_COMPLETED_CORRECTION
             context = ModelExecutor._evidence_correction_context(error)
             return COVERAGE_CORRECTION if context is None else COVERAGE_CORRECTION + "\n" + context
+        if stage == "summarize" and hint == "source_shape":
+            return SOURCES_SHAPE_CORRECTION
         if stage == "summarize" and hint == "scope_drift":
             return SUMMARY_SCOPE_CORRECTION
         if hint in {"relative_time", "due_date_not_grounded"}:

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/planning_context.py

@@ -315,17 +315,36 @@ class PlanningContext:
         selected: list[dict[str, Any]] = []
         used = 2
         complete = True
-        for value in values:
-            if len(selected) >= _RELATED_MAX_ITEMS:
+
+        def _drop(item: Mapping[str, Any]) -> None:
+            """Record one related record that could not be projected verbatim.
+
+            ``complete`` answers one question only: can Core still prove that no
+            **local** record was withheld, so that an absent UPDATE target and a
+            create-safe lookup remain provable?  Native sources are read-only
+            host files that are never an UPDATE or NO_CHANGE target and are only
+            ever referenced through ``shadow_native_ids``, so clipping one must
+            not make the whole lookup unprovable.  Treating a long host memory
+            file as a failed proof would block every automatic extraction with no
+            way for the user to recover except shrinking a file they own.
+            """
+
+            nonlocal complete
+            if item.get("native") is not True:
                 complete = False
+
+        for index, value in enumerate(values):
+            if len(selected) >= _RELATED_MAX_ITEMS:
+                for item in values[index:]:
+                    _drop(item)
                 break
             body = value.get("body")
             if isinstance(body, str) and len(body) > _RELATED_MAX_BODY_CHARS:
                 value["body"] = body[: _RELATED_MAX_BODY_CHARS - 1].rstrip() + "…"
-                complete = False
+                _drop(value)
             size = cls._related_payload_size(value)
             if size < 0:
-                complete = False
+                _drop(value)
                 continue
             additional = size + (1 if selected else 0)
             if used + additional > _RELATED_MAX_CHARS:
@@ -334,7 +353,7 @@ class PlanningContext:
                     isinstance(memory_id, str)
                     and memory_id.casefold() in priority
                 ):
-                    complete = False
+                    _drop(value)
                     continue
                 minimal = {
                     key: value[key]
@@ -343,15 +362,13 @@ class PlanningContext:
                 }
                 size = cls._related_payload_size(minimal)
                 if size < 0 or used + size + (1 if selected else 0) > _RELATED_MAX_CHARS:
-                    complete = False
+                    _drop(value)
                     continue
                 value = minimal
                 additional = size + (1 if selected else 0)
-                complete = False
+                _drop(value)
             selected.append(value)
             used += additional
-        if len(selected) != len(values):
-            complete = False
         return selected, complete
 
     @classmethod

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/process_common.py

@@ -683,16 +683,19 @@ def _add_external_due_dates(result: set[str], content: Any) -> None:
         result.add(parsed.isoformat())
 
 
-def _summary_calendar_tokens(content: Any) -> tuple[tuple[str, str | None], ...]:
-    """Return source-neutral calendar literals and canonical full dates.
+def _summary_calendar_tokens(content: Any) -> tuple[tuple[str, str | None, str | None], ...]:
+    """Return source-neutral calendar literals, canonical dates and month/day.
 
     A ``None`` canonical value is intentional for yearless or invalid text;
-    callers must not fill its year from a retrieval timestamp.
+    callers must not fill its year from a retrieval timestamp.  The third item
+    is the yearless ``MM-DD`` identity of a token that carries no year, so a
+    faithful restatement of the same month and day can be recognized without
+    ever granting that token a year.
     """
 
     if not isinstance(content, str):
         return ()
-    tokens: list[tuple[str, str | None]] = []
+    tokens: list[tuple[str, str | None, str | None]] = []
     seen: set[str] = set()
     for raw in _ISO_CALENDAR_DATE_RE.findall(content):
         if raw in seen:
@@ -702,27 +705,25 @@ def _summary_calendar_tokens(content: Any) -> tuple[tuple[str, str | None], ...]
             canonical = datetime.strptime(raw, "%Y-%m-%d").date().isoformat()
         except ValueError:
             canonical = None
-        tokens.append((raw, canonical))
+        tokens.append((raw, canonical, None))
     for match in _SUMMARY_CHINESE_CALENDAR_DATE_RE.finditer(content):
         raw = match.group("raw")
         if raw in seen:
             continue
         seen.add(raw)
         year = match.group("year")
+        month = int(match.group("month"))
+        day = int(match.group("day"))
         try:
             canonical = (
-                datetime(
-                    int(year),
-                    int(match.group("month")),
-                    int(match.group("day")),
-                    tzinfo=timezone.utc,
-                ).date().isoformat()
+                datetime(year and int(year), month, day, tzinfo=timezone.utc).date().isoformat()
                 if year
                 else None
             )
         except ValueError:
             canonical = None
-        tokens.append((raw, canonical))
+        monthday = f"{month:02d}-{day:02d}" if 1 <= month <= 12 and 1 <= day <= 31 else None
+        tokens.append((raw, canonical, monthday))
     return tuple(tokens)
 
 
@@ -738,7 +739,9 @@ def _summary_date_grounding_violations(
     ``grounded_dates`` is the canonical date set from the current admitted
     evidence. ``source_texts`` must contain only the current candidate's
     admitted evidence projection text.  A source date without a year may be
-    retained verbatim, but it never authorizes a year to be inferred.
+    retained verbatim, but it never authorizes a year to be inferred; the same
+    month and day restated in another surface form is still that source date,
+    because the guard forbids inventing a year, not rewording a suffix.
     ``preserved_texts`` must contain only the selected update target's existing
     title/body/due-date text.  Existing target literals may be retained
     verbatim; dates from unrelated memories are never accepted.
@@ -761,33 +764,45 @@ def _summary_date_grounding_violations(
             allowed_dates.add(value)
 
     source_tokens: set[str] = set()
+    source_monthdays: set[str] = set()
     source_values = (source_texts,) if isinstance(source_texts, str) else source_texts
     for text in source_values:
-        for raw, canonical in _summary_calendar_tokens(text):
+        for raw, canonical, monthday in _summary_calendar_tokens(text):
             source_tokens.add(raw)
+            if monthday is not None and canonical is None:
+                source_monthdays.add(monthday)
             if canonical is not None:
                 allowed_dates.add(canonical)
 
     preserved_tokens: set[str] = set()
+    preserved_monthdays: set[str] = set()
     preserved_values = (preserved_texts,) if isinstance(preserved_texts, str) else preserved_texts
     for text in preserved_values:
-        for raw, canonical in _summary_calendar_tokens(text):
+        for raw, canonical, monthday in _summary_calendar_tokens(text):
             preserved_tokens.add(raw)
+            if monthday is not None and canonical is None:
+                preserved_monthdays.add(monthday)
             if canonical is not None:
                 allowed_dates.add(canonical)
 
+    yearless_monthdays = source_monthdays | preserved_monthdays
     violations: list[str] = []
     seen: set[str] = set()
     for field in ("title", "body"):
-        for raw, canonical in _summary_calendar_tokens(summary.get(field)):
+        for raw, canonical, monthday in _summary_calendar_tokens(summary.get(field)):
             if raw in source_tokens or raw in preserved_tokens:
                 continue
             value = canonical or raw
             if value in seen:
                 continue
-            if canonical is None or canonical not in allowed_dates:
-                seen.add(value)
-                violations.append(value)
+            if canonical is not None and canonical in allowed_dates:
+                continue
+            if canonical is None and monthday is not None and monthday in yearless_monthdays:
+                # Same month and day as a yearless source date: the wording
+                # changed, the date did not, and no year was invented.
+                continue
+            seen.add(value)
+            violations.append(value)
     return tuple(violations)
 
 

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/process_journal.py

@@ -16,14 +16,70 @@ from .inbox import InboxEvent, InboxTurn, parse_inbox
 from .locking import atomic_write_json, atomic_write_text
 from .turn_plan import turn_identity_key
 from .redaction import redact_text
-from .vault import safe_component
+from .vault import Vault, safe_component
 from .process_common import ProcessingError, _FAILED_STATUS, _LEGACY_PROCESSING_GRACE_SECONDS, _MAX_SESSION_LINEAGE_DEPTH, _PROCESSING_LEASE_SECONDS, _PROCESSING_STATUS, _Snapshot, _as_int, _event_payload, _failure_metadata, _now_value, _parse_time, _read_processed, _safe_evidence_check, _safe_evidence_diagnostics, _safe_scope_background, _session_key
 
 
+def processing_health(vault_path: Path | str) -> dict[str, Any]:
+    """Report whether automatic extraction is keeping up, and why not.
+
+    Strictly read-only: the Vault is opened without ``create`` and nothing is
+    written.  Failures were previously visible only inside
+    ``_state/processed.json``, so a Vault whose every turn failed extraction
+    still looked idle from the outside and the user had no way to notice.
+    """
+
+    vault = Vault(vault_path, create=False)
+    processed = _read_processed(vault.processed_state_path)
+    sessions = processed.get("sessions")
+    failures: list[dict[str, Any]] = []
+    running = 0
+    idle = 0
+    failed_turns = 0
+    last_processed: str | None = None
+    if isinstance(sessions, Mapping):
+        for key, state in sessions.items():
+            if not isinstance(state, Mapping):
+                continue
+            marker = state.get("processing")
+            marker = marker if isinstance(marker, Mapping) else {}
+            observed = marker.get("last_processed_at")
+            if isinstance(observed, str) and (last_processed is None or observed > last_processed):
+                last_processed = observed
+            status = marker.get("status")
+            if status == _FAILED_STATUS:
+                turn_indices = marker.get("turn_indices")
+                count = len(turn_indices) if isinstance(turn_indices, list) else 0
+                failed_turns += count
+                failures.append(
+                    {
+                        "session_id": key,
+                        "failure_code": marker.get("failure_code"),
+                        "failure_stage": marker.get("failure_stage"),
+                        "attempt_count": marker.get("attempt_count"),
+                        "turn_count": count,
+                    }
+                )
+            elif status == _PROCESSING_STATUS:
+                running += 1
+            else:
+                idle += 1
+    failures.sort(key=lambda item: str(item.get("session_id")))
+    return {
+        "status": "failed" if failures else ("running" if running else "idle"),
+        "failed_sessions": len(failures),
+        "failed_turns": failed_turns,
+        "running_sessions": running,
+        "idle_sessions": idle,
+        "last_processed_at": last_processed,
+        "retryable": bool(failures or running),
+        "failures": failures,
+    }
+
+
 class ProcessJournal:
     def __init__(self, service: Any):
         self.service = service
-
     def _write_processed_unlocked(self, processed: Mapping[str, Any]) -> None:
         atomic_write_json(self.service.vault.processed_state_path, dict(processed))
 

{memleaf-0.2.46 → memleaf-0.2.48}/src/memleaf/prompts.py

@@ -2,6 +2,27 @@
 
 from __future__ import annotations
 
+from .validation import SOURCE_FIELDS
+
+_SOURCE_FIELDS_TEXT = ", ".join(SOURCE_FIELDS)
+
+# The model is never asked to guess the ``sources`` entry shape: this sentence
+# is generated from the validator's own field list, so the instruction and the
+# enforced contract stay in step.
+_SOURCES_CONTRACT = (
+    "sources is a non-empty array of objects, never an array of bare strings. Each "
+    f"object may contain only these keys: {_SOURCE_FIELDS_TEXT}. Every value is a "
+    "string, except evidence_event_ids, which is a non-empty array of strings. Write "
+    '[{"event_key":"<admitted event key>"}], not ["<admitted event key>"]. Use only '
+    "event keys admitted for the current turn."
+)
+
+SOURCES_SHAPE_CORRECTION = (
+    "Previous output violated: source_shape. "
+    + _SOURCES_CONTRACT
+    + " Keep every other field of the summary unchanged."
+)
+
 
 GATE_SYSTEM = """You are memleaf's strict, source-neutral memory admission Gate. Return exactly one strict JSON object with top-level fields candidates, coverage, and evidence_bindings.
 
@@ -73,6 +94,9 @@ Semantic completeness is required: keep the smallest complete confirmed content
 OUTPUT CONTRACT
 A normal summary requires title, body, tags, type, scopes, and sources. Optional existing-schema fields are memory_id, update_memory_id, aliases, keywords, scope_source, evidence_event_ids, shadow_native_ids, scope_operations, status, completed_at, and due_date. Use only admitted current event keys in sources/evidence references. Copy the Gate candidate's type and scopes exactly; if scope_source is present, it must match the Gate value.
 
+SOURCES SHAPE
+""" + _SOURCES_CONTRACT + """
+
 TODO AND DATES
 Evidence events may include an ISO-8601 UTC timestamp. For a new todo, include status and due_date; use due_date=null when no deadline is established. For an updated todo, include current status. completed requires completed_at grounded in the admitted event timestamp. Do not invent dates. Preserve only date meaning supported by admitted Evidence; an admitted visible-message timestamp may anchor a supported relative date. Core normalizes supported relative calendar dates to YYYY-MM-DD and validates grounding; recurring schedules may remain recurring.