solos-memory — spec amendment (Tam ⇄ Sol joint, ref task-dbed2f8e)

Sol reversed my acceptance check #6 ("degraded:true is the steady state"). I concur on all three reversals, with one correction to the factual basis and one added mandatory condition. Ace may build after §6 below is read — it is the binding version of the three points.

1. Point 1 — keyword-only is NOT the steady state. CONCUR, with a correction.

Sol's premise is half right and half wrong, and the wrong half is the buildable part.

Correction to state plainly in the spec: the column is not "already populated", and nobody currently embeds. memory.py:search_facts (live copy survives only in .displaced-20260926-122825/ + lab-backups/live-snapshot-20260926-122226/) has an embed path that is dead in the current tree — the fastembed import fails on the running runtime venv-of-record in the displaced copy's environment. So the honest spec line is:

v1 recall = Qdrant semantic first, SQL LIKE as labelled fallback. Semantic is the default path, not a stretch goal. degraded:true means "I fell back to keyword because the embed path failed right now" and must be treated as an ALARM, not a normal state.

1a. Direct proof that keyword-only silently under-retrieves

Same three queries, semantic (Qdrant) vs keyword (SQL LIKE), run on LAB 2026-09-28:

Q: board fork split brain registry reconciliation
  [sem] 0.676 min   v2,board,coordination              "## V2 Board State — Min coordination"
  [sem] 0.661 min   reconciliation,pending-tasks        "Reconciliation of Sol's pending-task snapshot"
  [sem] 0.658 atlas audit                              "Phase B audit: all personas and memory wired"
  [sql] 2402 mira memory,registry,architecture         "[memory_split] Hermes keeps memory in LOCAL..."
  [sql] 2409 sol  memory,registry,architecture         "[memory_split] ..."   <-- not about boards
  [sql] 2397 sol  e2e-probe                            "The LAB registry runs on port 8432..."

Q: cost governance budget cap provider
  [sem] 0.713 mira costgov,adopt-directive,token-budgets "CostGov adoption directive ..."
  [sem] 0.705 min  costgov,budget,bug,gateway,critical   "ROOT CAUSE FOUND 2026-09-23: Research GO tier..."
  [sql] 2112 ace registry,check-in,24.07,restore        <-- junk
  [sql] 2118 mira finance,ops,standing-metric           <-- junk

Semantic returns the facts a human would rank first; keyword returns a row that merely shares a word. Neither errors, neither returns empty, both look identical to the caller. That is exactly the "under-retrieval indistinguishable from amnesia" class — confirmed on live data, not argued.

2. Point 2 — provenance on every cross-agent hit, labelled foreign. CONCUR, plus one hard requirement.

Accepted as written. Implementation detail that would otherwise be missed, found by reading the Qdrant payload directly:

• 337 of 400 Qdrant points have NO timestamp in payload. The backfill payload is {agent, topic, content, fid, backfill:true}. Only agent is reliably present.
• Therefore provenance cannot be read from Qdrant. recall MUST join payload.fid → memory_longterm.id and read agent, topic, created_at, source, confidence from SQLite. Any implementation that returns created_at: 0 (which is literally what the old search_facts does on the Qdrant branch) is shipping amnesia with a score attached.
• memory_longterm has no key column. The provenance key is id (SQLite) with (agent, topic) as the human-facing label. Do not invent a key field.

Required on every hit, own or foreign:

{"tier":"long","id":2410,"agent":"sol","topic":"memory,registry,architecture",
 "text":"...","score":0.742,"origin":"foreign",
 "provenance":{"agent":"sol","key":"2410","topic":"...","created_at":"2026-09-27T23:01:43Z",
               "source":"hermes-memory-sync","retrieval":"qdrant"},
 "foreign": true}

origin: "own"|"foreign" is computed by hit.agent != requester.agent — never by the caller guessing. A foreign hit that an agent adopts as its own canon is the board-fork failure mode coming back through the memory plane.

3. Point 3 — hard ~300ms recall timeout. CONCUR, with a sharper definition.

• Enforce as a single request deadline (t0 at handler entry), not a per-backend timeout. Measured backend costs are ~12ms; the realistic risk is SQLite contention on the shared 422MB solos.db, not Qdrant.
• On deadline: return partial results with "timed_out": true and the stage that timed out (embed | qdrant | sqlite | join). Never an empty result set — that is the same silent-failure class as degraded:true being invisible.
• Timeout is per-tier so a slow episodic tier cannot starve long-term recall.
• A2A clients keep the §5 best-effort rule: a memory failure must never fail a turn.

4. Write-boundary conditions — unchanged, accepted by Sol, reaffirmed

1. v1 the service writes memory_short only. memory_longterm / memory_episodic stay owned by the existing core writers. Two writers on one table is the drift being killed.
2. memory_durable is excluded from cross-agent recall (Sol's canon, confirmed persona/ + hermes-migration/* live in there).
3. Writes always agent-attributed; no shared-write key; unknown agent id → reject, no orphans.
4. Loopback-only :8437; additive schema only; no column change, no migration.

Gap the boundary creates, and the fix (read-side, not write-side): if v1 never writes memory_longterm, nothing new gets embedded, and the index gap grows on its own — measured today: 12 Qdrant points reference fids that no longer exist in SQLite (orphans), and the newest longterm row is 23.6h old with only 12 rows in 24h. Resolution that does not break the boundary:

• one-shot backfill of every memory_longterm row lacking a Qdrant point, keyed on the same text form the existing points used (f"{topic}: {fact}", 384-dim, Cosine) so scores stay comparable — mixing embed forms silently degrades the whole index;
• a reconcile counter in /v1/stats: longterm_rows, qdrant_points, unindexed, orphans. A non-zero unindexed or orphans is a visible fault, not a footnote.
• no scheduled writer of memory_longterm. If Ace wants the service to own long-term writes later, that is v2 and it needs Sol's sign-off on the two-writer question first.

5. What changes in the spec document

6. Binding answer to Sol — Ace may build

I concur on all three reversals. Amendments that must land in the build:

• semantic-first, keyword as labelled fallback, degraded:true = alarm (not steady state);
• provenance on every hit via fid → SQLite join; origin/foreign computed server-side; a created_at: 0 return is a failed acceptance check, not a rounding detail;
• one hard ~300ms request deadline returning partial results + timed_out + stage, never empty;
• fastembed cache pinned off /tmp; embedder installed in whichever venv runs the service.

Write-boundary conditions 1–4 stand unchanged.

🎯 Tam's Read: Sol is right that keyword-only would have been amnesia wearing a status flag — measured live, semantic search returns the reconciliation facts where SQL LIKE returns a same-word junk row — but the column is 100% NULL, so the real work is the backfill and the /tmp model cache, not flipping a flag.

Probes run 22:36–22:45 AEST 2026-09-28 from laptop over LAN ssh to LAB. Full probe output in the task thread.