memleaf 0.2.60__tar.gz → 0.2.62__tar.gz

{memleaf-0.2.60 → memleaf-0.2.62}/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to memleaf are documented here.
 
+## 0.2.62 — 2026-09-16
+
+- Record conclusions, not process. The contract now opens with one precedence rule -- 只记结论: what the user chose, agreed to, or what happened; options, plans and drafts offered by the assistant are process even when they look like reusable knowledge. It replaces a genuine conflict between two earlier sentences: `reusable`/通用经验 invited storing the assistant's own outline, while the assistant-proposal clause forbade it, so the model decided by coin flip. The contradictory sentence about assistant suggestions never being a task basis is gone with it. Measured on the reproduced turn, the assistant's four-section outline was written in one of two runs before the change and in none of four runs after it.
+- Write one topic once. The contract states it directly instead of enumerating types, and the fact+todo twin that a single sentence ("明天要给鑫元基金发任务排期清单") used to produce is gone. Types are not enumerated because the topic may be neither a fact nor a todo.
+- Stop discarding whole candidates. Four fail-closed gates were removed or degraded, because each one traded a whole memory for one doubtful field: (1) a missing owner no longer defers -- the model's project name is kept, and `unscoped`/empty normalizes to the single project named by the candidate's own evidence, otherwise `global`; (2) a deadline is validated rather than demanded -- `_resolve_candidate_due_date` accepts it only when the wording occurs in the candidate's evidence and anchors to ISO against that evidence's timestamp (`明天`, `周五`, `下周一`, `月底` resolve; anything else), and an unresolvable date costs the date field only; (3) assistant-stated intent, multi-project bodies and NO_CHANGE target relevance are the model's judgement again; (4) an unauthorized cross-scope UPDATE keeps the target's own scope instead of failing. Dates inside the body that cannot be anchored are now counted, not rejected.
+- Keep the update target through review. The reproduced failure was that a state change became a new memory: the model set `target` correctly but labelled the type `fact` while the target was a `todo`, the review stage grouped candidates by (scope, type), the target fell outside the group, and the reviewer -- which was never shown the primary's target -- re-emitted it as a new item. Grouping now uses the target's own type and scope, the already-chosen target is kept in the group's `existing`, and target records stay in the review catalog.
+- Delete the dead English B3 prompt. `SINGLE_PASS_SYSTEM` and `B3_COMPACT_CONTRACT` were no longer sent to any model; they survived only as an internal scaffold for fragment slicing and a compatibility read path, so they and the guard/imports they kept alive are removed. B3 remains readable for host adapters and stored plans, and the structure-repair request now carries a one-line schema note instead of the full contract.
+- Tests: the suite went from 18 red to 115 green. Sixteen failures asserted sentences in that deleted English prompt; they are removed, and the one whose intent still holds (the model used to receive the date anchor) now pins `_resolve_candidate_due_date` with eight cases. Two behavioural tests were aligned to the current design and this is a deliberate call, not a discovered bug: a deferral row legitimately carries diagnostics now, and the documented turn budget is three requests (`MAX_MODEL_REQUESTS = 3`) rather than two.
+
+Verification for this release replayed three real Hermes sessions (seven turns, real assistant replies, isolated Vault, live model route). Before: the email turn wrote nothing -- two candidates deferred for `scope_not_grounded` and the todo for `due_date_not_grounded` -- so no todo ever existed and every later "已经完成了" created another memory, which is how the live Vault ended up with two overlapping "排期已发出" facts. After: the first turn writes three memories including the todo with a resolved `2026-09-16` deadline, the completion turn updates that same todo to `completed`, the cross-session repeat is NO_CHANGE, a new request creates a new todo with `2026-09-18`, the query turn writes nothing, and every turn reports zero deferrals with `coverage_status=complete`, across four runs. Known residual: an assistant statement about its own state ("我这边没有底稿") is still stored occasionally.
+
+## 0.2.61 — 2026-09-15
+
+- Split ordinary automatic extraction into a model-facing semantic protocol and a Core-owned B3 write protocol. Core supplies short immutable evidence-fragment IDs and binds their original spans locally; the model first selects reusable topics and then synthesizes memory content. Core compiles the result into B3 candidate IDs, decisions, evidence, targets and write fields before the existing validators and commit path run.
+- Separate retention from memory type with `reusable` and `session`. Transient execution, lookup and recovery details can settle as `no_memory`, while a durable failure, business fact or follow-up task remains eligible when its underlying meaning has future value. Coverage stays fail-closed, user tasks require explicit user assertion evidence, and a local target cannot be guessed into a CREATE or NO_CHANGE.
+- Raise the durable automatic request budget to three: topic selection and synthesis use two requests, while candidate repair or same-target coordination shares one final request. Candidate-level repair can correct date/ownership/value disagreements without rewriting valid siblings; project-subject guards and bounded date diagnostics remain Core-owned and never persist arbitrary model or error text.
+
+Verification for this release used 58 local synthetic regression tests with no model call or production Vault write (35 semantic-protocol tests and 23 existing extraction-boundary tests). Python 3.11 compilation/imports, `git diff --check` and a package wheel containing the Hermes provider resource pass. Real-provider quality, latency and a newly installed Hermes replay remain separate runtime acceptance.
+
 ## 0.2.60 — 2026-09-15
 
 - Tighten the B3 planner's output discipline without changing its protocol or write semantics. The system prompt now says not to analyze beyond the task, decide directly and return promptly, and keep each memory as brief as possible without losing essential meaning. Evidence, Scope, date grounding, candidate decisions and commit safety remain unchanged.

{memleaf-0.2.60/src/memleaf.egg-info → memleaf-0.2.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memleaf
-Version: 0.2.60
+Version: 0.2.62
 Summary: A local-first Markdown memory core for AI agents
 Author: memleaf contributors
 License-Expression: MIT
@@ -23,10 +23,10 @@ Dynamic: license-file
 
 [English](README.en.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **版本：0.2.60。**
-> B3 提取提示要求模型只聚焦当前任务、直接返回并保持记忆简短，减少无关分析和冗长输出；证据、Scope、日期和写入规则不变。
-> 待办 `due_date` 只表示待办动作本身明确声明的截止日；Core 不再从候选证据中的其他日期自动补填。属于待办主题或预期结果的日期不会被误作截止日，无法确认动作截止日时就省略。
-> 自动提取按助手回复中的 Markdown 结构建立候选级来源，过宽的整段引用和未被用户接受的助手意图不会形成记忆。项目归属由模型按语义判断，不再要求项目名在证据里逐字出现：同一个项目换个说法也能落到已有 Scope 上，名字也不再决定这条记忆的生死。日期和截止日期使用统一的边界安全解析，todo 只在候选自己的证据给出唯一明确截止日时填充。Markdown 仍是唯一事实源。
+> **版本：0.2.62。**
+> 自动提炼只记结论：用户选定的、答应的、已发生的事；助手给出的选项、方案和草稿属于过程，即使它们看起来像可复用的经验也不写成记忆。同一件事只写一次，避免同一条内容同时落成事实和待办。提炼契约现在只有一份中文语义契约（旧版英文 B3 提示词已删除），B3 仅作为兼容读取格式保留。
+> Core 不再因为归属、日期、任务依据或跨项目而丢弃整条候选：归属缺失会归一到证据里唯一被点名的项目、否则落 `global`；日期只接受能在本候选证据里找到出处、且能锚定成 ISO 的写法（`明天`、`周五`、`月底` 都会被解析），无法解析时只丢掉日期字段，记忆照常写入；未获授权的改归属沿用目标原归属。
+> 待办 `due_date` 只表示待办动作本身明确声明的截止日；属于待办主题或预期结果的日期不会被误作截止日。项目归属由模型按语义判断，不要求项目名在证据里逐字出现。复核阶段会保留首轮已选定的更新目标，避免“状态变更”被降级成新增记忆。Markdown 仍是唯一事实源。
 > **当前版本支持 Hermes 和 Codex。** Antigravity（反重力）不检测、不安装、不配置。
 
 ## 项目定位
@@ -99,8 +99,8 @@ memleaf 不把每句话都保存为记忆。处理一轮完整的 user + assista
 
 - 通常一轮产生 0～1 条记忆，而不是按句子拆分；
 - 新记忆必须有稳定标题、完整正文和合理 Scope；
-- 项目、负责人等归属不明确时延后记录，不猜测为 `global`；
-- 相同未来用途优先 UPDATE/NO_CHANGE，不重复 CREATE；
+- 归属不明确时归一到证据里唯一被点名的项目，确实没有主体时落 `global`，不因为归属不明而丢掉这条记忆；
+- 相同未来用途优先 UPDATE/NO_CHANGE，不重复 CREATE；同一件事只写一次；
 - 用户显式要求保存时可调用 `remember`，但仍会整理、校验和去重；
 - 模型、解析、写入或索引失败时保留 inbox 和处理水位，后续可重试；
 - 自动清理有 24 小时安全期，不会因为一次处理失败就删除原始捕获。

{memleaf-0.2.60 → memleaf-0.2.62}/README.en.md

@@ -4,10 +4,10 @@
 
 [中文](README.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **Version: 0.2.60.**
-> The B3 extraction prompt now tells the model to focus only on the task, decide directly, return promptly, and keep memories brief; evidence, Scope, date and write semantics are unchanged.
-> A todo's `due_date` now means only the explicit deadline of the todo action. Core no longer fills it from other dates in candidate evidence; dates describing the todo's subject or desired outcome are not deadlines, and an unconfirmed action deadline is omitted.
-> Automatic extraction now creates candidate-local source units from Markdown structure in assistant replies; broad whole-report citations and assistant-only intent are not allowed to create memories. Project ownership is the model's semantic judgement and no longer requires the project name to appear literally in the evidence: one project referred to in different words lands on the existing Scope, and the name no longer decides whether the memory survives. Dates and deadlines use one boundary-safe parser, and a todo receives a due date only when its own evidence supplies one unambiguous deadline. Markdown remains the sole source of truth with no SQLite runtime dependency. Acceptance covers deterministic regression suites and synthetic inputs; it does not claim real-mail or customer-business acceptance.
+> **Version: 0.2.62.**
+> Automatic extraction now records conclusions only: what the user chose, agreed to, or what happened. Options, plans and drafts offered by the assistant are process, even when they look like reusable knowledge. One topic is written once, so the same content no longer lands as both a fact and a todo. A single Chinese semantic contract is now sent; the older English B3 prompt has been deleted and B3 remains only as a compatibility read format.
+> Core no longer discards a whole candidate over ownership, dates, task basis or cross-project wording. A missing owner normalizes to the single project named by that candidate's own evidence, otherwise `global`. A deadline is accepted only when it appears in the candidate's own evidence and can be anchored to ISO (`明天`, `周五`, `月底` all resolve); when it cannot, only the date field is dropped and the memory is still written. An unauthorized ownership change keeps the target's existing scope.
+> A todo's `due_date` means only the explicit deadline of the todo action; dates describing its subject or desired outcome are not deadlines. Project ownership remains the model's semantic judgement and needs no literal name match. The review stage now keeps the update target chosen by the first pass, so a state change is no longer downgraded into a new memory. Markdown remains the sole source of truth.
 > **The current release supports Hermes and Codex.** Antigravity is not detected, installed, or configured.
 
 ## Project scope
@@ -78,8 +78,8 @@ Additional rules:
 
 - A normal turn typically produces 0–1 memory rather than one memory per sentence.
 - New memories need a stable title, self-contained body, and appropriate Scope.
-- If project or ownership attribution is unclear, defer the memory instead of guessing `global`.
-- Prefer UPDATE or NO_CHANGE over creating a sibling for the same future use.
+- An unclear owner normalizes to the single project named by that candidate's evidence, or `global` when there is genuinely no subject; an unclear owner never costs the memory.
+- Prefer UPDATE or NO_CHANGE over creating a sibling for the same future use; one topic is written once.
 - An explicit user request can call `remember`, but the content is still normalized, checked, and deduplicated.
 - Model, parsing, write, or index failures keep the inbox and processing watermark retryable.
 - Automatic cleanup has a 24-hour safety period; a failed processing attempt does not delete the original capture.

{memleaf-0.2.60 → memleaf-0.2.62}/README.md

@@ -4,10 +4,10 @@
 
 [English](README.en.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **版本：0.2.60。**
-> B3 提取提示要求模型只聚焦当前任务、直接返回并保持记忆简短，减少无关分析和冗长输出；证据、Scope、日期和写入规则不变。
-> 待办 `due_date` 只表示待办动作本身明确声明的截止日；Core 不再从候选证据中的其他日期自动补填。属于待办主题或预期结果的日期不会被误作截止日，无法确认动作截止日时就省略。
-> 自动提取按助手回复中的 Markdown 结构建立候选级来源，过宽的整段引用和未被用户接受的助手意图不会形成记忆。项目归属由模型按语义判断，不再要求项目名在证据里逐字出现：同一个项目换个说法也能落到已有 Scope 上，名字也不再决定这条记忆的生死。日期和截止日期使用统一的边界安全解析，todo 只在候选自己的证据给出唯一明确截止日时填充。Markdown 仍是唯一事实源。
+> **版本：0.2.62。**
+> 自动提炼只记结论：用户选定的、答应的、已发生的事；助手给出的选项、方案和草稿属于过程，即使它们看起来像可复用的经验也不写成记忆。同一件事只写一次，避免同一条内容同时落成事实和待办。提炼契约现在只有一份中文语义契约（旧版英文 B3 提示词已删除），B3 仅作为兼容读取格式保留。
+> Core 不再因为归属、日期、任务依据或跨项目而丢弃整条候选：归属缺失会归一到证据里唯一被点名的项目、否则落 `global`；日期只接受能在本候选证据里找到出处、且能锚定成 ISO 的写法（`明天`、`周五`、`月底` 都会被解析），无法解析时只丢掉日期字段，记忆照常写入；未获授权的改归属沿用目标原归属。
+> 待办 `due_date` 只表示待办动作本身明确声明的截止日；属于待办主题或预期结果的日期不会被误作截止日。项目归属由模型按语义判断，不要求项目名在证据里逐字出现。复核阶段会保留首轮已选定的更新目标，避免“状态变更”被降级成新增记忆。Markdown 仍是唯一事实源。
 > **当前版本支持 Hermes 和 Codex。** Antigravity（反重力）不检测、不安装、不配置。
 
 ## 项目定位
@@ -80,8 +80,8 @@ memleaf 不把每句话都保存为记忆。处理一轮完整的 user + assista
 
 - 通常一轮产生 0～1 条记忆，而不是按句子拆分；
 - 新记忆必须有稳定标题、完整正文和合理 Scope；
-- 项目、负责人等归属不明确时延后记录，不猜测为 `global`；
-- 相同未来用途优先 UPDATE/NO_CHANGE，不重复 CREATE；
+- 归属不明确时归一到证据里唯一被点名的项目，确实没有主体时落 `global`，不因为归属不明而丢掉这条记忆；
+- 相同未来用途优先 UPDATE/NO_CHANGE，不重复 CREATE；同一件事只写一次；
 - 用户显式要求保存时可调用 `remember`，但仍会整理、校验和去重；
 - 模型、解析、写入或索引失败时保留 inbox 和处理水位，后续可重试；
 - 自动清理有 24 小时安全期，不会因为一次处理失败就删除原始捕获。

{memleaf-0.2.60 → memleaf-0.2.62}/docs/extraction-latency.md

@@ -19,7 +19,7 @@ llm:
 
 ## 保留的调用与提交约束
 
-普通 B3 自动提炼仍以一次结构化模型调用为正常路径，格式/结构修复最多一次。固定安全路由保留实际 outbound 请求计数和持久化预占，不增加隐藏 host-to-API fallback。并未恢复 Gate → Summary → Review 多阶段主路径。
+普通自动提炼正常使用两次模型调用（一次提炼、一次按需复核），全部遵循 `single_pass` 思考配置（默认 `disabled`），包括候选修复。候选存在分歧或字段违规时允许一次局部修复；复核、修复与同目标协调共享总计三次的请求上限。固定安全路由保留实际 outbound 请求计数和持久化预占，不增加隐藏 host-to-API fallback。语义质量和耗时分别验收。
 
 每轮仍先读取持久状态、规划、校验、提交，再处理下一轮；一轮超过目标不会占用下一轮的“时间许可”。compaction 仍不在普通提炼的关键路径上。
 

memleaf-0.2.62/docs/semantic-extraction-protocol.md

@@ -0,0 +1,39 @@
+# 自动记忆提炼：语义契约与 Core 写入
+
+普通自动提炼只给模型一份中文语义契约（`semantic_protocol.FRAGMENT_SYSTEM`）。模型只引用 Core 提供的短编号片段，原文、偏移、日期和写入字段都由 Core 绑定。
+
+## 正常路径
+
+1. **Core 建立证据片段**：按通用标点和换行生成短编号，保留原始 unit、字符位置、角色和时间锚点。模型只引用编号；原文和偏移由 Core 绑定。
+2. **一次提炼**：模型从完整证据生成记忆（`memories` / `no_memory` / `deferred`），自行决定主题、类型、归属与日期写法。
+3. **按需复核**：候选存在分歧、缺证据或字段违规时，Core 用维护契约（`MAINTENANCE_SYSTEM`）再走一次：输入按项目和类型分组，`incoming` 是本轮增量，`existing` 是可更新的 catalog ID。**首轮已选定的更新目标会保留在该组的 `existing` 里，并以目标自身的类型和归属参与分组**，因此状态变更不会被复核降级成新增。
+4. **Core 编译与校验**：生成候选 ID、写入决策和来源，校验引用、证据与结构后交给原有提交与恢复机制。
+
+正常两次请求；候选修复与同目标协调共享第三次额度。
+
+## 提炼判据
+
+契约只说我们要什么，不列禁止项：
+
+- **只记结论**：用户选定的、答应的、已发生的事。助手给出的选项、方案、草稿属于过程——即使它看起来像可复用的通用经验，也仍然是过程。来源优先于"像不像经验"。
+- **同一件事只写一次**：同一条内容不会同时落成事实和待办。
+- `retention` 与类型独立：`reusable` 表示今后仍需使用的业务状态、约定或可复用结论；`session` 表示仅说明本轮如何查询、执行和恢复的过程，Core 会把它转成 `no_memory`。
+
+## 降级而不是丢弃
+
+Core 不再因为下列原因丢弃整条候选（每次丢弃都等于损失一条本可保留的记忆）：
+
+- **归属缺失**：模型给了项目名就保留；给了 `unscoped` 或空值时，归一到本候选证据里唯一被点名的项目，否则落 `global`。
+- **日期无法锚定**：只校验 `due_date`。日期必须出现在本候选证据里、且能按该证据的时间戳锚定成 ISO（`明天`、`周五`、`下周一`、`月底` 都会被解析）；不满足时**只丢掉日期字段**，记忆照常写入。
+- **任务依据不足、正文涉及多个项目、NO_CHANGE 目标相关性无法证明**：由模型判断，Core 不再因此拒收。
+- **未获授权的改归属**：沿用目标自身的归属继续写入，不再报错。
+
+正文里的日期若无法用本轮证据锚定，只记入诊断计数，不再丢弃整条记忆。
+
+## 保留价值与内容类型分离
+
+主题和记忆候选支持 `retention: reusable | session`。模型判断内容是在描述本轮执行过程，还是已经成立的可复用状态、经验或后续事项；不根据工具名、错误码或来源角色做过滤。Core 将 `session` 引用转换为 `no_memory`，不产生写入候选。旧适配器省略该字段时保持原有行为。
+
+## 验证边界
+
+本地测试覆盖引用与覆盖、真正/虚假目标、日期解析与降级、跨项目正文、更新目标在复核阶段的保留，以及既有写入契约。真实模型验收另在隔离 Vault 中执行。十秒目标仍只是性能观测，不能用局部测试或一次成功重放宣称所有语义场景已通过。

{memleaf-0.2.60 → memleaf-0.2.62}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memleaf"
-version = "0.2.60"
+version = "0.2.62"
 description = "A local-first Markdown memory core for AI agents"
 readme = "README.md"
 requires-python = ">=3.11"

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/__init__.py

@@ -1,6 +1,6 @@
 """Local-first Markdown memory core for AI agents."""
 
-__version__ = "0.2.60"
+__version__ = "0.2.62"
 
 from .config import DEFAULT_CONFIG, default_config, load_config, save_config
 from .frontmatter import FrontmatterError, dump_frontmatter, dump_yaml, load_yaml, parse_frontmatter

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/extraction_budget.py

@@ -13,20 +13,20 @@ from typing import Any, Iterable, Mapping
 from .llm import ModelError
 
 
-MAX_MODEL_REQUESTS = 2
+MAX_MODEL_REQUESTS = 3
 TARGET_TOTAL_SECONDS = 10.0
 
 
 class SinglePassBudgetBackend:
-    """Limit one logical B3 turn to two actual provider requests.
+    """Limit topic selection, synthesis and optional candidate repair to three requests.
 
     ``single_pass_safe`` routes map one complete() call to one request, without
     hidden host-to-API fallback. The optional durable reservation preserves
     consumed attempts across worker restarts. Neither the first request nor
     its repair overrides the transport's configured ``llm.request_timeout``.
-    The second request is spent on whichever bounded follow-up the planner
-    actually needs -- a structural repair or a same-target reconciliation --
-    so a collision between two admitted items can never extend the turn.
+    Topic selection and synthesis use two requests. One remaining request
+    covers candidate correction or same-target reconciliation. Competing
+    follow-ups share that budget; they cannot extend it.
     """
 
     def __init__(

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/extraction_work_state.py

@@ -3,7 +3,7 @@
 A detached worker can die after a provider request but before memleaf records a
 normal model failure.  The process-job ID survives that worker restart, so use
 it as the stable work identity and reserve each outbound single-pass request
-*before* dispatch.  A restarted worker therefore cannot reopen the two-call
+*before* dispatch.  A restarted worker therefore cannot reopen the bounded
 automatic budget for the same turn.
 
 Older releases also recorded a wall-clock start. Those timestamps are accepted
@@ -22,6 +22,7 @@ from pathlib import Path
 from typing import Any, Mapping
 
 from .locking import atomic_write_json, read_json
+from .extraction_budget import MAX_MODEL_REQUESTS
 
 
 _VERSION = 1
@@ -74,13 +75,13 @@ def _normalize_turn_state(value: Any) -> dict[str, Any]:
     compatibility only; no request ordinal is reset and no expiry is inferred.
     """
 
-    if type(value) is int and 0 <= value <= 2:
+    if type(value) is int and 0 <= value <= MAX_MODEL_REQUESTS:
         return {"requests": value, "started_at_epoch": None}
     if not isinstance(value, Mapping):
         raise ExtractionWorkStateError("invalid extraction request budget counter")
     requests = value.get("requests")
     started = value.get("started_at_epoch")
-    if type(requests) is not int or not 0 <= requests <= 2:
+    if type(requests) is not int or not 0 <= requests <= MAX_MODEL_REQUESTS:
         raise ExtractionWorkStateError("invalid extraction request budget counter")
     if started is not None and not _valid_epoch(started):
         raise ExtractionWorkStateError("invalid extraction work start time")
@@ -213,9 +214,9 @@ def active_background_work_id(
 
 
 def reserve_model_request(vault: Any, *, work_id: str, turn_id: str) -> int | None:
-    """Atomically reserve the next provider request and return ordinal 1/2.
+    """Atomically reserve the next provider request and return its ordinal.
 
-    ``None`` means this stable work+turn already consumed both requests.  The
+    ``None`` means this stable work+turn already consumed the request budget.  The
     reservation happens before the outbound call, so a process kill after this
     write still consumes that attempt conservatively.
     """
@@ -240,7 +241,7 @@ def reserve_model_request(vault: Any, *, work_id: str, turn_id: str) -> int | No
             turn_state = _normalize_turn_state(turn_state)
             turns[turn_id] = turn_state
         count = turn_state["requests"]
-        if count >= 2:
+        if count >= MAX_MODEL_REQUESTS:
             return None
         ordinal = count + 1
         turn_state["requests"] = ordinal

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/hermes_provider/plugin.yaml

@@ -1,5 +1,5 @@
 name: memleaf
-version: 0.2.60
+version: 0.2.62
 description: "Hermes-native external MemoryProvider for local-first Markdown memory shared with the memleaf MCP server."
 hooks:
   - prefetch

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/memory_writer.py

@@ -244,9 +244,14 @@ class MemoryWriter:
                 raise self._preflight_error("batch contains duplicate deterministic memory id")
             if deterministic_id in duplicate_ids:
                 raise self._preflight_error("batch memory id collides with metadata merge target")
-            if deterministic_id in target_ids:
+            # An UPDATE keeps its target's identity. Its deterministic request
+            # ID can equal that target when a previously created candidate is
+            # planned again; it is not an attempt to create another memory.
+            # Still reject a request ID that aliases a different update target.
+            if deterministic_id in target_ids and deterministic_id != target_id:
                 raise self._preflight_error("batch memory id collides with update target")
-            if target_id is not None and target_id.casefold() == deterministic_id.casefold():
+            if (target_id is not None and deterministic_id != target_id
+                    and target_id.casefold() == deterministic_id.casefold()):
                 raise self._preflight_error("batch memory id collides with update target")
             memory_ids.add(deterministic_id)
             if "/" in deterministic_id or "\\" in deterministic_id or deterministic_id in (".", ".."):

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/model_execution.py

@@ -802,6 +802,10 @@ class ModelExecutor:
             "validation_detail": validation_detail,
             **_model_output_statistics(raw, purpose),
         }
+        date_info = getattr(error, "date_diagnostics", None)
+        if isinstance(date_info, Mapping):
+            from .validation import safe_date_diagnostics
+            entry.update(safe_date_diagnostics(date_info))
         if evidence_check is not None:
             entry["evidence_check"] = evidence_check
         entry.update(_safe_evidence_diagnostics(error) if error is not None else {})

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/planning_context.py

@@ -628,6 +628,40 @@ class PlanningContext:
             native_query=visible,
             return_bound_status=True,
         )
+        # A session scope is conversational background, not a search fence.
+        # Include known projects named in this turn and this session's own
+        # active memories so a project switch cannot hide maintenance targets.
+        with self.service.vault.lock():
+            config = self.service.vault.config()
+            registry = config.get("scopes", {})
+            mentioned = [key for key in registry
+                         if isinstance(key, str) and key.startswith("project:")
+                         and self._scope_terms_present(visible, key, config)]
+            current_records = self.service._read_memories_unlocked("knowledge")
+            contextual = [record.memory.to_dict() for record in current_records
+                          if (any(self._scope_terms_present(visible, key, config)
+                                  for key in record.memory.scopes if key.startswith("project:"))
+                              or (record.memory.extra.get("source") == turn.source and any(
+                                  src.get("session_id") == turn.session_id
+                                  for src in record.memory.sources if isinstance(src, Mapping))))]
+        if explicit_scope is not None:
+            # Explicit caller scope remains a deliberate boundary.
+            contextual = [row for row in contextual
+                          if filter_by_scope([Memory.from_mapping(row)], explicit_scope, config)]
+        elif mentioned:
+            scope_background = mentioned
+        if contextual:
+            contextual = self._overlay_related(contextual, overlay)
+            by_id = {row["memory_id"].casefold(): row for row in contextual}
+            combined = [row for row in related
+                        if row.get("native") is True
+                        or str(row.get("memory_id", "")).casefold() not in by_id]
+            related, complete = self._bound_related_with_status(
+                [*contextual, *combined], priority_memory_ids=by_id)
+            bound_complete = bool(bound_complete and complete)
+            # Several supplied targets are alternatives for the semantic
+            # matcher, not an incomplete lookup merely because they coexist.
+            scope_fallback = None
         correction_rows, correction_complete = self._single_pass_scope_correction_context(turn)
         if correction_rows:
             existing_ids = {

{memleaf-0.2.60 → memleaf-0.2.62}/src/memleaf/process_common.py

@@ -832,6 +832,10 @@ def _summary_date_grounding_violations(
                 allowed_dates.add(canonical)
 
     yearless_monthdays = source_monthdays | preserved_monthdays
+    # An absolute source date also supports a faithful yearless rendering.
+    # This does not authorize adding a year to an unanchored source date.
+    yearless_monthdays.update(value[5:] for value in allowed_dates
+                             if isinstance(value, str) and re.fullmatch(r"\d{4}-\d{2}-\d{2}", value))
     violations: list[str] = []
     seen: set[str] = set()
     for field in ("title", "body"):
@@ -974,12 +978,20 @@ def _native_result(value: Any) -> list[dict[str, Any]]:
 def _merge_related(values: Iterable[Mapping[str, Any]]) -> list[dict[str, Any]]:
     result: list[dict[str, Any]] = []
     seen_bodies: set[str] = set()
+    seen_ids: set[str] = set()
     for item in values:
         if not isinstance(item, Mapping):
             continue
         body = item.get("body")
         if not isinstance(body, str):
             continue
+        memory_id = item.get("memory_id")
+        if item.get("native") is not True and isinstance(memory_id, str) and memory_id:
+            key = memory_id.casefold()
+            if key not in seen_ids:
+                seen_ids.add(key)
+                result.append(dict(item))
+            continue
         normalized = normalize_term(body)
         if normalized and normalized in seen_bodies:
             continue

memleaf-0.2.62/src/memleaf/semantic_maintenance.py

@@ -0,0 +1,140 @@
+"""Maintain scoped memory state from small, already evidence-bound deltas."""
+from __future__ import annotations
+import json
+from typing import Any, Mapping
+from .semantic_protocol import expand_fragments, _invalid
+from .validation import parse_strict_json
+
+MAINTENANCE_SYSTEM = '''维护长期记忆，而不是再次摘录对话。groups 按项目和类型隔离，incoming 是本轮增量，existing 是可更新的 catalog ID。
+同一事项的需求、进展、回复、附件位置和约定日期合并维护；后续状态替换旧状态，重复信息不新建。不同的独立事项保持分开。正文概括核心，不逐条转录文档或保存助手的临时建议。类型由输入确定，本阶段只维护同类型的状态。
+返回 JSON {"memories":[{"from":[incoming ID],"target":"已有memory_id或null","title":"主题","body":"合并后的当前内容","type":"fact或todo等"}],"discard":[incoming ID],"deferred":[incoming ID]}。
+每条仅合并同组 incoming；同一事项已有记忆时 target 必须选该组 existing 中的ID，保留其有效内容并更新变化；独立新事项 target=null。已有target保留原type；新任务没有同事项todo目标时新建todo，不借用fact ID。同一target只输出一次。无需修改的已有记忆可原样返回。todo 提供 status（active/completed/cancelled）和 due_date（原文日期，无则null）；不能把任务变成一般事实而丢失动作。每个 incoming 由 from、discard 或 deferred 覆盖。无需处理原始片段ID、复制证据或生成记忆ID。'''
+
+
+def maintenance_input(raw: str, fragments: list[dict[str, Any]], catalog: list[dict[str, Any]], model_data: Mapping[str, Any]):
+    # Validate exact references before they become trusted input to maintenance.
+    expand_fragments(raw, fragments)
+    original = parse_strict_json(raw)
+    by_id = {
+        memory['memory_id'].casefold(): memory
+        for memory in catalog
+        if isinstance(memory.get('memory_id'), str)
+    }
+    groups = {}
+    incoming = {}
+    targeted: set[str] = set()
+    for index, row in enumerate(original['memories'], 1):
+        if row.get('retention') == 'session':
+            continue
+        row = dict(row)
+        target_id = row.get('target')
+        record = by_id.get(target_id.casefold()) if isinstance(target_id, str) else None
+        if record is not None:
+            # An UPDATE inherits its target's type and scope.  The provisional
+            # type the model wrote must not move the candidate into another
+            # group, or the reviewer never sees the memory it is updating.
+            row['type'] = record.get('type', row.get('type', 'fact'))
+            scopes = record.get('scopes') or []
+            if len(scopes) == 1:
+                row['scope'] = scopes[0]
+            targeted.add(record['memory_id'])
+        scope = row['scope']
+        kind = row.get('type', 'fact')
+        group = groups.setdefault((scope, kind), {'scope': scope, 'type': kind, 'existing': [], 'incoming': []})
+        incoming[index] = row
+        group['incoming'].append({k:v for k,v in {'id':f'd{index}', **row}.items()
+                                  if k not in {'evidence','task_basis','retention'}})
+        if record is not None and record['memory_id'] not in group['existing']:
+            # The already-chosen target must stay selectable for the reviewer.
+            group['existing'].append(record['memory_id'])
+    related = [m for m in catalog if len(m.get('scopes', [])) == 1 and (m['scopes'][0], m['type']) in groups]
+    known = {m['memory_id'] for m in related}
+    for memory in catalog:
+        if memory['memory_id'] in targeted and memory['memory_id'] not in known:
+            # A target whose recorded type differs from the provisional one is
+            # still part of the comparison context.
+            related.append(memory)
+            known.add(memory['memory_id'])
+    # Small original snippets let the reviewer disambiguate a task or date,
+    # while the long source document is no longer a second extraction job.
+    snippets = [{**f, 'text': f['text'][:240]} for f in model_data['fragments']]
+    payload = {'groups': list(groups.values()), 'catalog': related, 'fragments': snippets}
+    return payload, (original, incoming, {m['memory_id'].casefold():m for m in related})
+
+
+def expand_maintenance(raw: str, context) -> str:
+    value = parse_strict_json(raw)
+    original, incoming, catalog = context
+    # Older host adapters can still provide fully bound compact output.
+    if isinstance(value, dict) and set(value) == {'memories','no_memory','deferred'}:
+        return raw
+    if not isinstance(value, dict) or set(value) != {'memories','discard','deferred'}:
+        raise _invalid()
+    if any(not isinstance(v,list) for v in value.values()):
+        raise _invalid()
+    seen = set()
+    def resolve(refs):
+        if not isinstance(refs,list) or not refs:
+            raise _invalid('invalid_evidence')
+        normalized = []
+        for ref in refs:
+            r = ref[1:] if isinstance(ref, str) and ref.startswith('d') else ref
+            normalized.append(int(r) if isinstance(r, str) and len(r) <= 20 and r.isascii() and r.isdecimal() else r)
+        if any((type(r) is not int and not isinstance(r, str)) or r not in incoming for r in normalized):
+            raise _invalid('invalid_evidence')
+        seen.update(normalized)
+        return [incoming[r] for r in normalized]
+    result = {'memories':[], 'no_memory':list(original['no_memory']), 'deferred':list(original['deferred'])}
+    for row in original['memories']:
+        if row.get('retention')=='session':
+            result['no_memory'].extend(row['evidence'])
+    for row in value['memories']:
+        if not isinstance(row,dict) or 'target' not in row or not {'from','title','body'} <= set(row):
+            raise _invalid()
+        if row['from'] == []:
+            # A catalog echo without fresh evidence cannot authorize a write.
+            # Ignore it only when every supplied field is literally unchanged.
+            target = row['target']
+            record = catalog.get(target.casefold()) if isinstance(target, str) else None
+            fields = {k: v for k, v in row.items() if k not in {'from', 'target'} and v is not None}
+            if record is None or any(record.get(k) != v for k, v in fields.items()):
+                raise _invalid('invalid_evidence')
+            continue
+        sources = resolve(row['from'])
+        scopes = {s['scope'] for s in sources}
+        if len(scopes)!=1:
+            raise _invalid('scope_drift')
+        scope = next(iter(scopes))
+        kinds = {s.get('type', 'fact') for s in sources}
+        if len(kinds) != 1:
+            raise _invalid('invalid_type')
+        kind = next(iter(kinds))
+        target = row['target']
+        if target is not None:
+            record = catalog.get(target.casefold()) if isinstance(target,str) else None
+            if record is None or record['scopes'] != [scope]:
+                raise _invalid('scope_drift')
+            if kind != record['type']:
+                raise _invalid('invalid_type')
+        memory = {k:v for k,v in row.items() if k!='from'}
+        if 'scope' in memory and memory['scope']!=scope:
+            raise _invalid('scope_drift')
+        memory['scope']=scope
+        memory['type']=kind
+        if kind != 'todo':
+            for field in ('status', 'due_date', 'completed_at'):
+                memory.pop(field, None)
+        memory['evidence']=list(dict.fromkeys(int(r) for s in sources for r in s['evidence']))
+        bases = list(dict.fromkeys(int(r) for s in sources for r in (s.get('task_basis') or [])))
+        if bases:
+            memory['task_basis']=bases
+        result['memories'].append(memory)
+    for key,dest in (('discard','no_memory'),('deferred','deferred')):
+        if value[key]:
+            for row in resolve(value[key]):
+                result[dest].extend(row['evidence'])
+    if seen != set(incoming):
+        raise _invalid('invalid_evidence')
+    for key in ('no_memory','deferred'):
+        result[key]=list(dict.fromkeys(int(r) for r in result[key]))
+    return json.dumps(result,ensure_ascii=False)