pbuffer 0.1.0__tar.gz → 0.2.0__tar.gz

{pbuffer-0.1.0/src/pbuffer.egg-info → pbuffer-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pbuffer
-Version: 0.1.0
+Version: 0.2.0
 Summary: A world-state database: an append-only log of everything true in a world - places, people, objects, knowledge, time. Deploy it under a game, AI agent, or real-world tracker for permanent, queryable world memory: current state, location, history, and who-knows-what, answered by deterministic queries instead of model calls.
 License: MIT
 Requires-Python: >=3.11
@@ -27,8 +27,9 @@ One append-only log of perspective-scoped, time-indexed assertions about entitie
 
 > A player places a pipe in a drawer in session 12 of a D&D campaign. Two hundred sessions pass without a mention. At retirement, the player opens the drawer — and the pipe is there, exactly as placed, with the original moment's full history behind it. No maintenance was ever performed. In this architecture, **silence is persistence**: state is folded from the log, never re-inferred and never kept alive by mention. The world remembers so the model doesn't have to.
 
-**Status: pre-1.0; substrate validated, ingestion fidelity is the open
-front.** The engine passes its 419-test invariant suite, and the chapter test
+**Status: pre-1.0; substrate validated in BOTH modes, the ingestion-fidelity
+front closed by a measured contract.** The engine passes its 482-test
+invariant suite, and the chapter test
 (ingest a complete noir mystery, delete the prose, interrogate the store
 against a hand-authored answer key) has been graded across three full runs.
 The substrate's invariants held in all of them — sealed containers stayed
@@ -43,8 +44,20 @@ single commit) replaced serial prompt-iterated extraction after measurement
 showed prose contracts fragment differently every round; identity and key
 fragmentation died as failure classes, and pass-0 registry quality is where
 the remaining extraction failures concentrate. Run 4, with its checkable
-predictions, is in flight. Not yet installable from PyPI; the shipped example
-world with a zero-API-key query tour lands once a verified run stamps it.
+predictions, is in flight. Tracking mode is now proven as more than a policy
+flag: trust decays with **unconfirmed wall time** under declared per-attribute
+half-lives, while in fiction the page stays true forever — same log, same
+reads, two honest physics.
+
+## Install
+
+```bash
+pip install pbuffer          # the engine (zero dependencies) — import patternbuffer
+pip install pbuffer[mcp]     # + the MCP server: patternbuffer-mcp --world w.world --world-id w:id
+```
+
+*(The PyPI distribution is `pbuffer` — the exact name `patternbuffer` was taken
+by an unrelated project; the import is `patternbuffer` throughout.)*
 
 ## What this is
 
@@ -71,6 +84,8 @@ The buffer holds the pattern; materialization is re-entry; degradation is the fa
 6. ~~The porcelain API + host integration.~~ Done — and proven in the strongest form. The frozen contract (`porcelain-v0.1`, additive-only): five load-bearing verbs — `ingest` (+`ingest_structured`) / `snapshot` / `ask` / `materialize` / `resolve`+`refer()` — over a fuller read-and-identity family (`state`, `where`, `aggregate`, `neighborhood`, `frame_diff`, `who_knows`, `correlate`, `route`, `entities`, `facts`, build sessions, `axis_heads`, …). The first *live* host, [Construct](https://github.com/5000Stadia/construct) (an interactive-fiction engine — `pattern` → `construct` loads it → `holonovel`), runs **entirely on this contract**: zero engine-internal reaches, its 800+-test suite green on the pure public surface. The engine-independent claim, demonstrated rather than asserted. (Intended primary host: [Kernos](https://github.com/5000Stadia/Kernos), adapter pattern.)
 7. ~~The interactive-fiction milestone (thunk stability across sessions, frame-scoped NPCs, multi-path mystery, clocks, loop closure).~~ Met in the field — every item is exercised in [Construct](https://github.com/5000Stadia/construct)'s live suite (the first host runs entirely on the frozen porcelain). These are host-layer criteria, proven by the adopter, not a further engine deliverable.
 8. ~~The MCP wrapper~~ — built: `pip install pbuffer[mcp]` → `patternbuffer-mcp --world w.world --world-id w:id` serves the frozen porcelain's **37 deterministic verbs** over stdio to any MCP client — read, query, and *build* a world with zero Python (the genuinely model-free subset; model-backed verbs are V1.1 via sampling). One server ↔ one world; a connected client is a fully **trusted world principal** — frame entitlement for untrusted consumers stays host-mediated. The framework-agnostic claim, proven by demonstration. Far field: the first host's V2 roadmap publicly assigns branch-worlds simulation and its curiosity loop to this engine — the two roadmaps meet in the middle.
+9. ~~Tracking mode: the second-mode thesis, proven~~ (TRACKING-MODE-V1). Trust and story time are now formally separate axes. In **fiction**, confidence recency is *permanent* — the page is true, and story-time liveness belongs to salience, not trust. In **tracking** worlds (`observe_or_unknown`), trust decays with **unconfirmed wall time** under declared per-attribute half-lives (`DecayPolicy` — data, not config: `attr:in · decay_halflife_seconds · 2 days`), fail-closed (`unconfigured`/`unconfirmed` exclude recency and renormalize, never fake a score) with a finite-clock contract (a broken clock can never manufacture freshness). `confidence()` carries `recency`, `recency_status`, `last_confirmed_at_wallclock` on every result — "last confirmed June 19, 22 days unconfirmed" is one join. The mode selector is the *policy*, never a stance judgment: the engine applies **no plausibility bias** to observer reports in either mode. Receipts: `evals/the_grey_house/` (the replayable tracking eval), 14/14 scorecard.
+10. ~~The ingestion-fidelity contract, evidence-gated end to end~~ (INGESTION-FIDELITY-V1 → V2). V1 shipped `fidelity_audit()` — the structural gap read (coreference collision groups, unstamped timed facts, orphans, open conflicts) the host joins for severity. The first live host's full rebuild then delivered the measured signals: the coreference seal took live collisions 8→4 with zero severe, and the audit residue decomposed into exactly one real defect class — standing personal properties (`build`, `occupation`, kinship, `can_*`) authored as timed state. V2 shipped that contract narrowly: timeless means *true across the world's whole history* (facts of origin only — everything acquired gets its earliest supported time; age is never timeless), the classifier prefers standing classes for enduring-baseline traits, kinship-of-origin is one host declaration (`attribute_default`), and merge-induced self-edges receipt distinctly (`merged_self_edge`). The remaining candidate (background-homonym coreference) was **parked forever with cause** — every residual group unvouched, none load-bearing, replay-proved harmless. Machinery without a measured victim doesn't ship.
 
 ## License
 

{pbuffer-0.1.0 → pbuffer-0.2.0}/README.md

@@ -13,8 +13,9 @@ One append-only log of perspective-scoped, time-indexed assertions about entitie
 
 > A player places a pipe in a drawer in session 12 of a D&D campaign. Two hundred sessions pass without a mention. At retirement, the player opens the drawer — and the pipe is there, exactly as placed, with the original moment's full history behind it. No maintenance was ever performed. In this architecture, **silence is persistence**: state is folded from the log, never re-inferred and never kept alive by mention. The world remembers so the model doesn't have to.
 
-**Status: pre-1.0; substrate validated, ingestion fidelity is the open
-front.** The engine passes its 419-test invariant suite, and the chapter test
+**Status: pre-1.0; substrate validated in BOTH modes, the ingestion-fidelity
+front closed by a measured contract.** The engine passes its 482-test
+invariant suite, and the chapter test
 (ingest a complete noir mystery, delete the prose, interrogate the store
 against a hand-authored answer key) has been graded across three full runs.
 The substrate's invariants held in all of them — sealed containers stayed
@@ -29,8 +30,20 @@ single commit) replaced serial prompt-iterated extraction after measurement
 showed prose contracts fragment differently every round; identity and key
 fragmentation died as failure classes, and pass-0 registry quality is where
 the remaining extraction failures concentrate. Run 4, with its checkable
-predictions, is in flight. Not yet installable from PyPI; the shipped example
-world with a zero-API-key query tour lands once a verified run stamps it.
+predictions, is in flight. Tracking mode is now proven as more than a policy
+flag: trust decays with **unconfirmed wall time** under declared per-attribute
+half-lives, while in fiction the page stays true forever — same log, same
+reads, two honest physics.
+
+## Install
+
+```bash
+pip install pbuffer          # the engine (zero dependencies) — import patternbuffer
+pip install pbuffer[mcp]     # + the MCP server: patternbuffer-mcp --world w.world --world-id w:id
+```
+
+*(The PyPI distribution is `pbuffer` — the exact name `patternbuffer` was taken
+by an unrelated project; the import is `patternbuffer` throughout.)*
 
 ## What this is
 
@@ -57,6 +70,8 @@ The buffer holds the pattern; materialization is re-entry; degradation is the fa
 6. ~~The porcelain API + host integration.~~ Done — and proven in the strongest form. The frozen contract (`porcelain-v0.1`, additive-only): five load-bearing verbs — `ingest` (+`ingest_structured`) / `snapshot` / `ask` / `materialize` / `resolve`+`refer()` — over a fuller read-and-identity family (`state`, `where`, `aggregate`, `neighborhood`, `frame_diff`, `who_knows`, `correlate`, `route`, `entities`, `facts`, build sessions, `axis_heads`, …). The first *live* host, [Construct](https://github.com/5000Stadia/construct) (an interactive-fiction engine — `pattern` → `construct` loads it → `holonovel`), runs **entirely on this contract**: zero engine-internal reaches, its 800+-test suite green on the pure public surface. The engine-independent claim, demonstrated rather than asserted. (Intended primary host: [Kernos](https://github.com/5000Stadia/Kernos), adapter pattern.)
 7. ~~The interactive-fiction milestone (thunk stability across sessions, frame-scoped NPCs, multi-path mystery, clocks, loop closure).~~ Met in the field — every item is exercised in [Construct](https://github.com/5000Stadia/construct)'s live suite (the first host runs entirely on the frozen porcelain). These are host-layer criteria, proven by the adopter, not a further engine deliverable.
 8. ~~The MCP wrapper~~ — built: `pip install pbuffer[mcp]` → `patternbuffer-mcp --world w.world --world-id w:id` serves the frozen porcelain's **37 deterministic verbs** over stdio to any MCP client — read, query, and *build* a world with zero Python (the genuinely model-free subset; model-backed verbs are V1.1 via sampling). One server ↔ one world; a connected client is a fully **trusted world principal** — frame entitlement for untrusted consumers stays host-mediated. The framework-agnostic claim, proven by demonstration. Far field: the first host's V2 roadmap publicly assigns branch-worlds simulation and its curiosity loop to this engine — the two roadmaps meet in the middle.
+9. ~~Tracking mode: the second-mode thesis, proven~~ (TRACKING-MODE-V1). Trust and story time are now formally separate axes. In **fiction**, confidence recency is *permanent* — the page is true, and story-time liveness belongs to salience, not trust. In **tracking** worlds (`observe_or_unknown`), trust decays with **unconfirmed wall time** under declared per-attribute half-lives (`DecayPolicy` — data, not config: `attr:in · decay_halflife_seconds · 2 days`), fail-closed (`unconfigured`/`unconfirmed` exclude recency and renormalize, never fake a score) with a finite-clock contract (a broken clock can never manufacture freshness). `confidence()` carries `recency`, `recency_status`, `last_confirmed_at_wallclock` on every result — "last confirmed June 19, 22 days unconfirmed" is one join. The mode selector is the *policy*, never a stance judgment: the engine applies **no plausibility bias** to observer reports in either mode. Receipts: `evals/the_grey_house/` (the replayable tracking eval), 14/14 scorecard.
+10. ~~The ingestion-fidelity contract, evidence-gated end to end~~ (INGESTION-FIDELITY-V1 → V2). V1 shipped `fidelity_audit()` — the structural gap read (coreference collision groups, unstamped timed facts, orphans, open conflicts) the host joins for severity. The first live host's full rebuild then delivered the measured signals: the coreference seal took live collisions 8→4 with zero severe, and the audit residue decomposed into exactly one real defect class — standing personal properties (`build`, `occupation`, kinship, `can_*`) authored as timed state. V2 shipped that contract narrowly: timeless means *true across the world's whole history* (facts of origin only — everything acquired gets its earliest supported time; age is never timeless), the classifier prefers standing classes for enduring-baseline traits, kinship-of-origin is one host declaration (`attribute_default`), and merge-induced self-edges receipt distinctly (`merged_self_edge`). The remaining candidate (background-homonym coreference) was **parked forever with cause** — every residual group unvouched, none load-bearing, replay-proved harmless. Machinery without a measured victim doesn't ship.
 
 ## License
 

{pbuffer-0.1.0 → pbuffer-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pbuffer"
-version = "0.1.0"
+version = "0.2.0"
 description = "A world-state database: an append-only log of everything true in a world - places, people, objects, knowledge, time. Deploy it under a game, AI agent, or real-world tracker for permanent, queryable world memory: current state, location, history, and who-knows-what, answered by deterministic queries instead of model calls."
 readme = "README.md"
 requires-python = ">=3.11"

{pbuffer-0.1.0 → pbuffer-0.2.0}/src/patternbuffer/__init__.py

@@ -76,6 +76,10 @@ class World:
         )
         self.indexes.set_closure_provider(self.registry.closure)
         self.indexes.set_correlation_provider(self.registry.correlation_set)
+        # TRACKING-MODE-V1: tracking-vs-non-tracking selects on policy ONLY
+        # (never stance — the no-bias invariant); deny is a resolution policy,
+        # not an epistemic mode, so it takes the non-tracking branch.
+        self.indexes.set_time_physics(policy == OBSERVE_OR_UNKNOWN, clock)
         self.registry.set_kind_provider(lambda e: self.indexes.fold_key(e, "kind"))
         self.salience_index = SalienceIndex(self.buffer, self.classifier, self.indexes)
         self.indexes.set_salience_provider(self.salience_index.salience)
@@ -192,10 +196,14 @@ class World:
         frame: str | list[str] = CANON,
         as_of: float | None = None,
         asserted_as_of: int | None = None,
+        now: float | None = None,
     ) -> dict:
+        # `now` is WALL time (TRACKING-MODE-V1): the staleness reference in
+        # tracking worlds, defaulting to the injected clock; unused in fiction.
+        # Never a second meaning for as_of (which stays valid time).
         return self.indexes.confidence(
             entity, attribute, frame=frame, as_of=as_of,
-            asserted_as_of=asserted_as_of,
+            asserted_as_of=asserted_as_of, now=now,
         )
 
     def neighborhood(self, entity: str, **kw) -> dict:

{pbuffer-0.1.0 → pbuffer-0.2.0}/src/patternbuffer/classify.py

@@ -145,7 +145,12 @@ class Classifier:
             "STATE: what it is RIGHT NOW (positions of movables, moods, conditions). "
             "One event could flip it.\n\n"
             "The mutability test resolves most ambiguity: could one event flip this "
-            "without re-authoring the world? -> STATE. Asymmetric defaults: an "
+            "without re-authoring the world? -> STATE. When the text presents a "
+            "property as an enduring baseline of the person — a physical trait, a "
+            "capability, a continuing role — prefer CONSTITUTIVE (what they are) or "
+            "DISPOSITIONAL (how they tend) over STATE; a temporary ability or "
+            "condition, or a time-relative quantity (age), remains STATE. "
+            "Asymmetric defaults: an "
             "ambiguous property is STATE; ambiguous fixture containment is "
             "CONSTITUTIVE."
         )

pbuffer-0.2.0/src/patternbuffer/decay.py

@@ -0,0 +1,62 @@
+"""DecayPolicy: tracking-world time physics as declared, rebuildable data.
+
+TRACKING-MODE-V1 §B3: in an `observe_or_unknown` world, a fact's freshness
+decays with UNCONFIRMED WALL TIME — per-attribute half-lives declared as
+ordinary rows (never stored results; the policy is read fresh at each read and
+rebuilds from the log). Deliberately SEPARATE from `AttributeSemantics`: decay
+is world physics, not fold semantics — a declaration on the inviolable-core
+`in` key must configure, not be rejected.
+
+Declaration rows:  `attr:<key> · decay_halflife_seconds · <finite positive n>`
+World default:     `attr:__world__ · decay_halflife_seconds · <n>`
+
+Lookup for a served winner authored as attribute A (deterministic, Cx 563):
+  1. `attr:<A>` — exact policy for the winner's canonical authored attribute;
+  2. if A is in the containment family: `attr:in` — the public family subject
+     (the private `__containment__` fold sentinel is never host vocabulary);
+  3. `attr:__world__` — the world default.
+First hit wins. Later declarations fold at current head (latest visible per
+subject). Policy resolution is CURRENT-physics-over-history by design: as-of
+confidence applies today's declared physics to historical facts (documented).
+"""
+
+from __future__ import annotations
+
+import math
+
+from patternbuffer.buffer import PatternBuffer
+
+PREDICATE = "decay_halflife_seconds"
+WORLD_SUBJECT = "attr:__world__"
+
+
+class DecayPolicy:
+    def __init__(self, buffer: PatternBuffer, semantics) -> None:
+        self._buffer = buffer
+        self._semantics = semantics
+
+    def resolve(self, authored_attribute: str) -> float | None:
+        """The half-life (seconds) governing a winner authored as
+        `authored_attribute`, or None (unconfigured)."""
+        v = self._latest(f"attr:{authored_attribute}")
+        if v is not None:
+            return v
+        family = (self._semantics.containment_family()
+                  if self._semantics is not None else frozenset())
+        if authored_attribute in family and authored_attribute != "in":
+            v = self._latest("attr:in")
+            if v is not None:
+                return v
+        return self._latest(WORLD_SUBJECT)
+
+    def _latest(self, subject: str) -> float | None:
+        """The latest visible valid declaration on `subject` (ordinary
+        supersession at current head); malformed values never activate."""
+        best = None
+        for row in self._buffer.visible(entity=subject, attribute=PREDICATE):
+            v = row.value
+            if (isinstance(v, (int, float)) and not isinstance(v, bool)
+                    and math.isfinite(v) and v > 0):
+                if best is None or row.asserted_at > best.asserted_at:
+                    best = row
+        return float(best.value) if best is not None else None

{pbuffer-0.1.0 → pbuffer-0.2.0}/src/patternbuffer/indexes.py

@@ -26,6 +26,7 @@ from patternbuffer.codec import (
     exact_div,
     exact_sum,
 )
+from patternbuffer.decay import DecayPolicy
 from patternbuffer.model import ATTR_PREFIX, CANON, META_ATTRIBUTES, Assertion
 from patternbuffer.semantics import AttributeSemantics, CONTAINMENT, builtin_default
 
@@ -108,6 +109,19 @@ class Indexes:
             lambda eid, valid_as_of=None, asserted_as_of=None, frame=CANON: {eid}
         )
         self._salience = lambda eid, frame=CANON, as_of=None: 0.0
+        # TRACKING-MODE-V1: time physics. `_tracking` selects on
+        # policy == "observe_or_unknown" ONLY (never stance — the no-bias
+        # invariant); `_clock` is the World's injected wall clock; `_decay`
+        # reads declared half-lives fresh at each read (rebuildable).
+        self._tracking = False
+        self._clock: Callable[[], float] = lambda: 0.0
+        self._decay = DecayPolicy(buffer, self._semantics)
+
+    def set_time_physics(self, tracking: bool, clock: Callable[[], float]) -> None:
+        """World wiring (TRACKING-MODE-V1): tracking = the operational selector
+        (`policy == "observe_or_unknown"`); clock = the injected wall clock."""
+        self._tracking = tracking
+        self._clock = clock
 
     def set_identity_resolver(self, fn: Callable[[str], str]) -> None:
         self._resolve = fn
@@ -207,8 +221,95 @@ class Indexes:
             "last_observed_at": None,
             "corroboration": 0,
             "conflicted": False,
+            # TRACKING-MODE-V1: one payload shape everywhere — the three
+            # additive fields are present (null) on empty/set-valued/accrue.
+            "recency": None,
+            "recency_status": None,
+            "last_confirmed_at_wallclock": None,
         }
 
+    def _time_trust(
+        self,
+        winner: Assertion,
+        entity: str,
+        attribute: str,
+        frames: list[str],
+        as_of: float | None,
+        asserted_as_of: int | None,
+        now: float | None,
+    ) -> tuple[float | None, str, float | None]:
+        """(recency, recency_status, last_confirmed_at_wallclock) —
+        TRACKING-MODE-V1's frozen branches.
+
+        Non-tracking (invent_under_canon / deny): ("permanent", 1.0, None) —
+        the page is true; story-time recency is salience's business (liveness),
+        never trust's. Tracking: recency = 2**(−age/half_life) with
+        age = max(0, now − stamp); "unconfigured"/"unconfirmed" return
+        recency=None (excluded + renormalized upstream — fail-closed: neither
+        fake permanence nor fake staleness)."""
+        if not self._tracking:
+            return 1.0, "permanent", None
+        # The finite-clock contract (Cx 604 #1), validated FIRST — before any
+        # branch can short-circuit: wall time must be a finite real number. A
+        # NaN stamp would make max(0, now−NaN) select 0.0 — a broken clock
+        # fabricating PERFECT freshness. A non-finite explicit/injected `now`
+        # fails loudly on every tracking read; non-finite STORED stamps never
+        # qualify as confirmations (enforced in _confirmation_stamp).
+        ref_now = float(now) if now is not None else float(self._clock())
+        if not math.isfinite(ref_now):
+            raise ValueError(
+                f"wall-clock 'now' must be finite, got {ref_now!r} "
+                "(a broken clock must fail, not fabricate freshness)")
+        half_life = self._decay.resolve(winner.attribute)
+        if half_life is None:
+            return None, "unconfigured", None
+        stamp = self._confirmation_stamp(
+            winner, entity, attribute, frames, as_of, asserted_as_of
+        )
+        if stamp is None:
+            return None, "unconfirmed", None
+        age = max(0.0, ref_now - float(stamp))
+        return 2.0 ** (-(age / float(half_life))), "configured", float(stamp)
+
+    def _confirmation_stamp(
+        self,
+        winner: Assertion,
+        entity: str,
+        attribute: str,
+        frames: list[str],
+        as_of: float | None,
+        asserted_as_of: int | None,
+    ) -> float | None:
+        """The latest visible A1 wall stamp among rows that CONFIRM the served
+        value: `stated`/`observed` provenance only, strict value-equivalence to
+        the winner, frame- and asserted_as_of-respecting (TRACKING-MODE-V1 §B4).
+        An assumed/inferred/conflicting/different-value row never refreshes it.
+        Fail-closed: a tracking row missing its mandatory stamp contributes no
+        confirmation."""
+        best: float | None = None
+        for f in frames:
+            for row in self._visible_key_rows(
+                entity, attribute, frame=f,
+                valid_as_of=as_of, asserted_as_of=asserted_as_of,
+            ):
+                if row.status not in ("stated", "observed"):
+                    continue
+                if not self._confidence_values_equivalent(row, winner):
+                    continue
+                for meta in self._buffer.visible(
+                    entity=row.id, attribute="learned_at_wallclock",
+                    asserted_as_of=asserted_as_of,
+                ):
+                    v = meta.value
+                    # FINITE only (Cx 604 #1): a NaN/inf stamp must fall to
+                    # the honest `unconfirmed` branch, never qualify as a
+                    # confirmation (fail-closed).
+                    if (isinstance(v, (int, float)) and not isinstance(v, bool)
+                            and math.isfinite(v)):
+                        if best is None or float(v) > best:
+                            best = float(v)
+        return best
+
     def _confidence_values_equivalent(self, left: Assertion, right: Assertion) -> bool:
         # Corroboration is "same value" (post-impl review): STRICT equivalence,
         # not the loose approximate-bounds agreement — a {gte:40} bound must not
@@ -387,6 +488,7 @@ class Indexes:
         frame: str | list[str] = CANON,
         as_of: float | None = None,
         asserted_as_of: int | None = None,
+        now: float | None = None,
     ) -> dict:
         """Derived trust score for one functional folded key.
 
@@ -406,7 +508,7 @@ class Indexes:
         """
         if not isinstance(frame, str):
             return self._confidence_multiframe(
-                entity, attribute, list(frame), as_of, asserted_as_of
+                entity, attribute, list(frame), as_of, asserted_as_of, now
             )
         entity = self._resolve(entity)
         if self._semantics.is_set_valued(attribute) or self._semantics.is_accrue(attribute):
@@ -431,22 +533,13 @@ class Indexes:
             # stated fact (post-impl review).
             provenance = min(provenance, max(0.0, min(1.0, winner.confidence)))
 
-        if winner.valid_from is None:
-            recency = 1.0
-        else:
-            ref = as_of
-            if ref is None:
-                closure_rows = self._buffer.visible(
-                    entity_in=sorted(self._closure_of(entity)),
-                    frame=frame,
-                    asserted_as_of=asserted_as_of,
-                )
-                ref = max(
-                    (row.valid_from for row in closure_rows if row.valid_from is not None),
-                    default=winner.valid_from,
-                )
-            age = max(0.0, float(ref) - float(winner.valid_from))
-            recency = 1.0 / (1.0 + age / params["recency_scale"])
+        # TRACKING-MODE-V1: the recency component. Non-tracking = permanent
+        # (the fiction anti-decay amendment — story-time decay removed from
+        # trust; liveness is salience's axis). Tracking = wall-clock age under
+        # the declared DecayPolicy, with the fail-closed null branches.
+        recency, recency_status, confirmed_at = self._time_trust(
+            winner, entity, attribute, [frame], as_of, asserted_as_of, now
+        )
 
         source_classes = {self._source_class(winner, asserted_as_of)}
         for assertion_id in fold.corroborated_by:
@@ -469,11 +562,20 @@ class Indexes:
         )
 
         weights = params["weights"]
-        score = (
-            weights["provenance"] * provenance
-            + weights["recency"] * recency
-            + weights["corroboration"] * corroboration_score
-        )
+        if recency is None:
+            # unconfigured/unconfirmed: the recency term is EXCLUDED and its
+            # weight renormalized over the remaining components (fail-closed).
+            denom = weights["provenance"] + weights["corroboration"]
+            score = (
+                weights["provenance"] * provenance
+                + weights["corroboration"] * corroboration_score
+            ) / denom
+        else:
+            score = (
+                weights["provenance"] * provenance
+                + weights["recency"] * recency
+                + weights["corroboration"] * corroboration_score
+            )
         if fold.conflicted:
             score *= 0.5
         score = min(1.0, max(0.0, score))
@@ -483,6 +585,9 @@ class Indexes:
             "last_observed_at": winner.valid_from,
             "corroboration": corroboration,
             "conflicted": fold.conflicted,
+            "recency": recency,
+            "recency_status": recency_status,
+            "last_confirmed_at_wallclock": confirmed_at,
         }
 
     def _confidence_multiframe(
@@ -492,6 +597,7 @@ class Indexes:
         frames: list[str],
         as_of: float | None,
         asserted_as_of: int | None,
+        now: float | None = None,
     ) -> dict:
         """Confidence over the read-union of `frames` (CONFIDENCE-MULTIFRAME-V1).
 
@@ -514,7 +620,8 @@ class Indexes:
         if len(ordered) == 1:
             # Reduction: a single distinct frame is byte-identical to the str
             # path (and inherits its full V1 corroboration recovery).
-            return self.confidence(entity, attribute, ordered[0], as_of, asserted_as_of)
+            return self.confidence(entity, attribute, ordered[0], as_of,
+                                   asserted_as_of, now)
 
         entity = self._resolve(entity)
         if self._semantics.is_set_valued(attribute) or self._semantics.is_accrue(attribute):
@@ -555,23 +662,12 @@ class Indexes:
         if winner.confidence is not None:
             provenance = min(provenance, max(0.0, min(1.0, winner.confidence)))
 
-        if winner.valid_from is None:
-            recency = 1.0
-        else:
-            ref = as_of
-            if ref is None:
-                closure = sorted(self._closure_of(entity))
-                refs = [
-                    row.valid_from
-                    for f in ordered
-                    for row in self._buffer.visible(
-                        entity_in=closure, frame=f, asserted_as_of=asserted_as_of
-                    )
-                    if row.valid_from is not None
-                ]
-                ref = max(refs) if refs else winner.valid_from
-            age = max(0.0, float(ref) - float(winner.valid_from))
-            recency = 1.0 / (1.0 + age / params["recency_scale"])
+        # TRACKING-MODE-V1: same frozen branches as the single-frame path —
+        # one payload shape, the stamp taken per the EFFECTIVE winner over the
+        # frame union.
+        recency, recency_status, confirmed_at = self._time_trust(
+            winner, entity, attribute, ordered, as_of, asserted_as_of, now
+        )
 
         # Corroboration: distinct source classes attesting the EFFECTIVE served
         # value (Codex post-impl finding 2). Counting sources that back a
@@ -611,11 +707,18 @@ class Indexes:
         )
 
         weights = params["weights"]
-        score = (
-            weights["provenance"] * provenance
-            + weights["recency"] * recency
-            + weights["corroboration"] * corroboration_score
-        )
+        if recency is None:
+            denom = weights["provenance"] + weights["corroboration"]
+            score = (
+                weights["provenance"] * provenance
+                + weights["corroboration"] * corroboration_score
+            ) / denom
+        else:
+            score = (
+                weights["provenance"] * provenance
+                + weights["recency"] * recency
+                + weights["corroboration"] * corroboration_score
+            )
         if conflicted:
             score *= 0.5
         score = min(1.0, max(0.0, score))
@@ -625,6 +728,9 @@ class Indexes:
             "last_observed_at": winner.valid_from,
             "corroboration": corroboration,
             "conflicted": conflicted,
+            "recency": recency,
+            "recency_status": recency_status,
+            "last_confirmed_at_wallclock": confirmed_at,
         }
 
     def _fold_accrue(self, rows: list[Assertion]) -> FoldResult:

{pbuffer-0.1.0 → pbuffer-0.2.0}/src/patternbuffer/ingest.py

@@ -14,6 +14,7 @@ without it.
 from __future__ import annotations
 
 import logging
+import math
 import re
 import time
 from dataclasses import dataclass
@@ -120,9 +121,16 @@ _EXTRACT_RULES_FULL = (
     "- SPACE: emit connects_to edges for every passage/route the text "
     "describes (stairs, gates, corridors); never invent an edge the text "
     "does not support — vertical proximity is not connectivity.\n"
-    "- TIME: timeless=true ONLY for identity and structure (kind, names, "
-    "fixed adjacency). Everything that happens or holds-at-a-time gets "
-    "valid_from on the provided timeline.\n"
+    "- TIME: timeless=true ONLY for what holds across the world's whole "
+    "history: identity/structure (kind, names, fixed adjacency) and facts of "
+    "origin (kinship of origin, innate traits presented as what the person "
+    "has always been). Everything acquired or mutable gets valid_from — a "
+    "dated onset when the text gives one ('became a soldier at the war'); "
+    "otherwise the earliest supported point (the entity's introduction or "
+    "the scene cursor). Time-relative quantities (age) are current state at "
+    "the cursor, never timeless. Standing-but-acquired properties "
+    "(occupation, scars, learned skills) are NOT timeless — stamp them at "
+    "their earliest supported time.\n"
     "- Repeated habits, spoken catchphrases, confrontations, confessions, "
     "and scheduled/conditional future events are assertions too (use event: "
     "entities with caused_by where the text gives causality).\n"
@@ -147,8 +155,14 @@ _EXTRACT_RULES_LEAN = (
     "- ALWAYS extract location changes: X moves/leaves/arrives => a new 'in' "
     "row for X. Presence and departure are core state, never atmosphere "
     "(a departure that goes unrecorded makes presence lie).\n"
-    "- timeless=true ONLY for identity/structure (kind, names, fixed adjacency); "
-    "everything else gets valid_from.\n"
+    "- timeless=true ONLY for what holds across the world's whole history: "
+    "identity/structure (kind, names, fixed adjacency) and facts of origin "
+    "(kinship of origin, innate traits). Everything acquired or mutable gets "
+    "valid_from — the dated onset if given, else the earliest supported "
+    "point (the entity's introduction or the scene cursor). Time-relative "
+    "quantities (age) are current state at the cursor, never timeless; "
+    "standing-but-acquired properties (occupation, scars, learned skills) "
+    "are NOT timeless — stamp them at their earliest supported time.\n"
     "- NEVER invent: extract only what the text supports; atmosphere is not an "
     "assertion.\n"
     "- The narrative voice is not an entity: never emit person: entities for "
@@ -449,10 +463,22 @@ class Ingestor:
         ):
             self._record_skip(entity, attribute, value, "malformed_id")
             return out
+        raw_entity, raw_value = entity, value
         entity = self._registry.resolve(entity)
         if value_type == "entity" and isinstance(value, str):
             value = self._registry.resolve(value)
 
+        # Decay-policy declarations must be valid physics (TRACKING-MODE-V1
+        # §B3): a malformed half-life is skip-receipted at the gate, never
+        # silently active (DecayPolicy would ignore it — but a silent ignore
+        # reads as "declared" to the author; the receipt says it fell).
+        if attribute == "decay_halflife_seconds" and not (
+            isinstance(value, (int, float)) and not isinstance(value, bool)
+            and math.isfinite(value) and value > 0
+        ):
+            self._record_skip(entity, attribute, value, "invalid_decay_halflife")
+            return out
+
         # Edge-granular structural guard (Part B): a single invalid edge
         # (containment cycle / self-edge / lateral self-loop) is SKIPPED with a
         # typed receipt — the invariant holds (it never enters) and the rest of
@@ -462,6 +488,16 @@ class Ingestor:
             item.get("frame", CANON), None if timeless else valid_from,
         )
         if skip is not None:
+            # INGESTION-FIDELITY-V2 §D: two raw ids that resolve to one
+            # identity head post-`same_as` are a MERGE footprint, not an
+            # authored self-edge — the distinct reason (raw ids retained)
+            # makes the diagnosis actionable. Containment-only per the
+            # GREEN'd spec; a merged lateral loop keeps its original
+            # reason. Gate behavior is identical: the row never enters.
+            if (entity == value and raw_entity != raw_value
+                    and self._semantics.is_containment(attribute)):
+                skip = (f"merged_self_edge: {raw_entity!r} and {raw_value!r} "
+                        f"resolve to the same entity {entity!r} — {skip}")
             self._record_skip(entity, attribute, value, skip)
             return out  # nothing appended
 
@@ -585,9 +621,18 @@ class Ingestor:
             if not _ID_RE.fullmatch(pov):
                 raise ValueError(f"pov {pov!r} is not a valid entity id")
             rules += (
-                f"- First/second-person pronouns (I, you, we) referring to the "
-                f"viewpoint character are {pov} — never mint a new entity for "
-                f"them.\n"
+                # The FULL deictic family incl. possessives (HD 126: "my hand"
+                # once bound sideways to the nearest NPC — fabricated canon).
+                # Scoped per Cx 570: singular deixis is exclusively the POV;
+                # plural deixis INCLUDES the POV without proving exclusive
+                # ownership or licensing guessed members.
+                f"- Viewpoint deixis: I, me, my, mine, myself — and you, your, "
+                f"yours when the narration addresses the viewpoint character — "
+                f"refer to {pov}; never mint a new entity for them, and a "
+                f"singular possessee (my hand, your coat) is NEVER attributed "
+                f"to any other present character. Plural we, us, our, ours "
+                f"INCLUDE {pov}: never guess the other members and never "
+                f"rebind the plural wholesale to a nearby character.\n"
             )
         prompt = f"{rules}{context}\n\nPASSAGE:\n{text}"
         # RAW output, verbatim (INGEST-LATENCY-V2; Cx 545): extract() returns the

{pbuffer-0.1.0 → pbuffer-0.2.0}/src/patternbuffer/porcelain.py

@@ -638,10 +638,15 @@ class Porcelain:
         attribute: str,
         frame: str | list[str] = CANON,
         as_of: float | None = None,
+        now: float | None = None,
     ) -> dict:
         # frame may be a list: trust over an observer's effective knowledge
         # (knows:O ∪ public), mirroring multi-frame frame_diff.
-        return self._w.confidence(entity, attribute, frame=frame, as_of=as_of)
+        # now (TRACKING-MODE-V1): the WALL-time staleness reference in tracking
+        # worlds (defaults to the injected clock; unused in fiction). The
+        # payload carries recency/recency_status/last_confirmed_at_wallclock.
+        return self._w.confidence(entity, attribute, frame=frame, as_of=as_of,
+                                  now=now)
 
     def neighborhood(
         self,