Persist passive working-memory decay

gabewillen · gabewillen · commit 7281d960d051 · 2026-07-14T11:30:34.000-05:00
diff --git a/docs/paper/_manuscript/index.md b/docs/paper/_manuscript/index.md
@@ -2189,12 +2189,23 @@ accounting use separate timestamps so repeated maintenance passes charge
 each elapsed interval once without making an untouched slot appear
 recently accessed:
 
-    Δt_decay ← max(0, now_s() − strength_ts)
-    strength ← max(strength_floor(F,S,T),
-                   strength − maintenance_cost_per_memory × Δt_decay)
-    strength_ts ← max(strength_ts, now_s())
+    Δt_decay ← now_s() − strength_ts
+    if Δt_decay > 0:
+      strength ← max(strength_floor(F,S,T),
+                     strength − maintenance_cost_per_memory × Δt_decay)
+      strength_ts ← now_s()
     # last_ts changes only on chunking, rehearsal, or insertion
 
+The active floor is applied only while charging positive elapsed time. A
+same-time or out-of-order signal therefore cannot recharge a slot that
+was legitimately persisted below the current floor under an earlier knob
+setting.
+
+Persisted working-memory rows mirror `strength_ts` as
+`strength_updated_at`. Load-time decay advances the same timestamp and
+leaves changed slot metadata dirty so the next normal process persists
+both values.
+
 The manifold_complexity is defined as a normalized local variability
 proxy (see Appendix B): manifold_complexity ← clamp((1 −
 mean_cos_window) / 2, 0, 1).
@@ -3496,8 +3507,11 @@ boundaries, interrupts, candidate totals, threshold and effective-focus
 sums, and final memory, association, and embedding counts. The observed
 throughput difference is within run-to-run variation. This comparison
 covers the core operation and persistence loop with synthetic
-embeddings, not model inference or language-runtime overhead; the
-implemented checks add no per-signal query or eager graph rebuild.
+embeddings, not model inference or language-runtime overhead. At that
+measured head, the implemented checks added no per-signal query or eager
+graph rebuild. The later passive-decay durability repair adds at most
+one bounded memory-row update per changed live slot during normal
+persistence and is outside this historical measurement.
 
 Separately, the July 8 retention work was run through the normalized
 memory-eval smoke slice with all configured benchmark adapters, using
@@ -5100,10 +5114,12 @@ fanout limits. Working-memory and soft-anchor updates operate over
 bounded live state and remain independent of total store size.
 
 The safety checks preserve these bounds: bind-result validation is one
-branch per existing parameter, working-memory decay adds one timestamp
-update per bounded slot, and graph writes perform only O(1) cache
-invalidation. None adds a per-signal database query or eager graph
-reconstruction.
+branch per existing parameter, working-memory decay advances one
+timestamp per bounded slot and schedules at most one memory-row update
+per changed slot during normal persistence, and graph writes perform
+only O(1) cache invalidation. None adds a store-size-dependent query or
+eager graph reconstruction; working-memory persistence remains bounded
+by the configured live-slot capacity.
 
 The retained long-horizon optimization target is that mean process
 latency stays approximately flat as the database grows. The July 2026
diff --git a/docs/paper/sections/10_implementation.qmd b/docs/paper/sections/10_implementation.qmd
@@ -167,9 +167,11 @@ soft-anchor updates operate over bounded live state and remain independent of
 total store size.
 
 The safety checks preserve these bounds: bind-result validation is one branch
-per existing parameter, working-memory decay adds one timestamp update per
-bounded slot, and graph writes perform only O(1) cache invalidation. None adds
-a per-signal database query or eager graph reconstruction.
+per existing parameter, working-memory decay advances one timestamp per bounded
+slot and schedules at most one memory-row update per changed slot during normal
+persistence, and graph writes perform only O(1) cache invalidation. None adds a
+store-size-dependent query or eager graph reconstruction; working-memory
+persistence remains bounded by the configured live-slot capacity.
 
 The retained long-horizon optimization target is that mean process latency
 stays approximately flat as the database grows. The July 2026 exact-replay
diff --git a/docs/paper/sections/6_advanced_cognitive.qmd b/docs/paper/sections/6_advanced_cognitive.qmd
@@ -91,13 +91,22 @@ separate timestamps so repeated maintenance passes charge each elapsed interval
 once without making an untouched slot appear recently accessed:
 
 ```
-Δt_decay ← max(0, now_s() − strength_ts)
-strength ← max(strength_floor(F,S,T),
-               strength − maintenance_cost_per_memory × Δt_decay)
-strength_ts ← max(strength_ts, now_s())
+Δt_decay ← now_s() − strength_ts
+if Δt_decay > 0:
+  strength ← max(strength_floor(F,S,T),
+                 strength − maintenance_cost_per_memory × Δt_decay)
+  strength_ts ← now_s()
 # last_ts changes only on chunking, rehearsal, or insertion
 ```
 
+The active floor is applied only while charging positive elapsed time. A
+same-time or out-of-order signal therefore cannot recharge a slot that was
+legitimately persisted below the current floor under an earlier knob setting.
+
+Persisted working-memory rows mirror `strength_ts` as `strength_updated_at`.
+Load-time decay advances the same timestamp and leaves changed slot metadata
+dirty so the next normal process persists both values.
+
 The manifold_complexity is defined as a normalized local variability proxy (see Appendix B): manifold_complexity ← clamp((1 − mean_cos_window) / 2, 0, 1).
 
 ### Memory-Level Gating
diff --git a/docs/paper/sections/9_experimental.qmd b/docs/paper/sections/9_experimental.qmd
@@ -166,8 +166,10 @@ boundaries, interrupts, candidate totals, threshold and effective-focus sums,
 and final memory, association, and embedding counts. The observed throughput
 difference is within run-to-run variation. This comparison covers the core
 operation and persistence loop with synthetic embeddings, not model inference
-or language-runtime overhead; the implemented checks add no per-signal query
-or eager graph rebuild.
+or language-runtime overhead. At that measured head, the implemented checks
+added no per-signal query or eager graph rebuild. The later passive-decay
+durability repair adds at most one bounded memory-row update per changed live
+slot during normal persistence and is outside this historical measurement.
 
 Separately, the July 8 retention work was run through the normalized memory-eval
 smoke slice with all configured benchmark adapters, using durable history
diff --git a/src/operations/working_memory.cpp b/src/operations/working_memory.cpp
@@ -103,15 +103,27 @@ WorkingMemory::Execute (OperationContext &context, Transaction &tx) const
     {
       const double last_decay
           = slot.strength_ts > 0.0 ? slot.strength_ts : slot.last_ts;
-      const double dt = std::max (0.0, now_s - last_decay);
-      // Decay strength but floor at a minimum to preserve slot
-      // Slot will be replaced via eviction when capacity is reached
-      const double strength_after
-          = std::max (core::WMStrengthFloor (
-                          cfg.focus, cfg.sensitivity, cfg.stability),
-                      slot.strength - cost_per_slot * dt);
+      const double dt = now_s - last_decay;
+      double strength_after = slot.strength;
+      double strength_ts_after = slot.strength_ts;
+      if (dt > 0.0)
+        {
+          // Decay strength but floor at a minimum to preserve the slot. The
+          // active floor applies only while charging positive elapsed time;
+          // a knob change must not recharge an already-weaker slot.
+          strength_after
+              = std::max (core::WMStrengthFloor (
+                              cfg.focus, cfg.sensitivity, cfg.stability),
+                          slot.strength - cost_per_slot * dt);
+          strength_ts_after = now_s;
+        }
+      if (slot.strength != strength_after
+          || slot.strength_ts != strength_ts_after)
+        {
+          slot.metadata_dirty = true;
+        }
       slot.strength = strength_after;
-      slot.strength_ts = std::max (last_decay, now_s);
+      slot.strength_ts = strength_ts_after;
     }
 
   // Complexity penalty from entropy over strengths.
diff --git a/src/signal_processor.cpp b/src/signal_processor.cpp
@@ -12,6 +12,7 @@
 #include "cortext/store/utils.hpp"
 #include "operations/constructive_recall_internal.hpp"
 #include "operations/historical_surface_search_cache_internal.hpp"
+#include "working_memory_time_internal.hpp"
 #include <algorithm>
 #include <atomic>
 #include <chrono>
@@ -1783,25 +1784,29 @@ LoadWorkingMemory (Store &store, ProcessorContext &ctx,
           // DB stores milliseconds, convert to seconds for last_ts
           const auto ts_ms = ExtractInt64 (row, "last_access", now_ms);
           slot.last_ts = static_cast<double> (ts_ms) / 1000.0;
-          const auto strength_ts_ms
+          const auto persisted_strength_ts_ms
               = ExtractInt64 (row, "strength_updated_at", ts_ms);
+          const auto strength_ts_ms = persisted_strength_ts_ms > 0
+                                          ? persisted_strength_ts_ms
+                                          : ts_ms;
           slot.strength_ts = static_cast<double> (strength_ts_ms) / 1000.0;
           slot.start_ts = ExtractInt64 (row, "start_ts", 0);
 
           // Apply time-based decay
+          const double strength_before = slot.strength;
+          const double strength_ts_before = slot.strength_ts;
           const double now_s = static_cast<double> (now_ms) / 1000.0;
           const double elapsed = now_s - slot.strength_ts;
           if (elapsed > 0)
             {
               slot.strength
                   = std::max (strength_floor,
                               slot.strength - cost_per_slot * elapsed);
+              slot.strength_ts = now_s;
             }
-          else
-            {
-              slot.strength = std::max (strength_floor, slot.strength);
-            }
-          slot.strength_ts = std::max (slot.strength_ts, now_s);
+          const bool metadata_changed
+              = slot.strength != strength_before
+                || slot.strength_ts != strength_ts_before;
 
           // Load extended metadata
           slot.n_signals = static_cast<int> (ExtractInt64 (row, "n_signals", 1));
@@ -1899,7 +1904,7 @@ LoadWorkingMemory (Store &store, ProcessorContext &ctx,
             }
 
           slot.persisted_signal_record_count = slot.signal_records.size ();
-          slot.metadata_dirty = false;
+          slot.metadata_dirty = metadata_changed;
           slot.embedding_dirty = false;
           slot.signal_records_dirty = false;
           ctx.wm_slots.push_back (std::move (slot));
@@ -2830,7 +2835,7 @@ SignalProcessor::PersistWorkingMemory (Transaction &tx, bool force,
   bool all_slots_clean = true;
 
   // Upsert current slots as MEMORIES with kind='WORKING'. Clean slots are
-  // left untouched; passive decay is recovered from last_access on reload.
+  // left untouched; passive maintenance marks changed metadata dirty.
   for (auto &slot : context_->wm_slots)
     {
       std::string failure_stage = "slot_precheck";
@@ -2859,10 +2864,10 @@ SignalProcessor::PersistWorkingMemory (Transaction &tx, bool force,
 
       try
         {
-          const auto ts_ms = static_cast<int64_t> (slot.last_ts * 1000.0);
-          const auto strength_ts_ms = static_cast<long long> (
-              (slot.strength_ts > 0.0 ? slot.strength_ts : slot.last_ts)
-              * 1000.0);
+          const auto ts_ms
+              = internal::WorkingMemorySecondsToMillis (slot.last_ts);
+          const auto strength_ts_ms = internal::WorkingMemorySecondsToMillis (
+              slot.strength_ts > 0.0 ? slot.strength_ts : slot.last_ts);
           const auto slot_created_at
               = slot.start_ts > 0
                     ? static_cast<long long> (slot.start_ts)
diff --git a/src/working_memory_time_internal.hpp b/src/working_memory_time_internal.hpp
@@ -0,0 +1,32 @@
+#pragma once
+
+#include <cmath>
+#include <cstdint>
+#include <stdexcept>
+
+namespace cortext::internal
+{
+
+/// Convert a finite, nonnegative working-memory timestamp to the nearest
+/// signed-64-bit millisecond. The exclusive upper bound is exactly 2^63,
+/// which remains representable even when double and long double both have
+/// 53-bit precision.
+inline int64_t
+WorkingMemorySecondsToMillis (double seconds)
+{
+  if (!std::isfinite (seconds) || seconds < 0.0)
+    {
+      throw std::invalid_argument (
+          "Working-memory timestamp must be finite and nonnegative");
+    }
+
+  const double millis = seconds * 1000.0;
+  constexpr double kExclusiveUpperMillis = 0x1p63;
+  if (!std::isfinite (millis) || millis >= kExclusiveUpperMillis)
+    {
+      throw std::out_of_range ("Working-memory timestamp exceeds int64 range");
+    }
+  return static_cast<int64_t> (std::llround (millis));
+}
+
+} // namespace cortext::internal
diff --git a/tests/operations_working_memory.test.cpp b/tests/operations_working_memory.test.cpp
@@ -225,6 +225,7 @@ TEST_CASE ("Alg24 maintenance charges each elapsed interval once",
   slot.strength = 2.0;
   slot.last_ts = 0.0;
   slot.strength_ts = 0.0;
+  slot.metadata_dirty = false;
   pctx.wm_slots.push_back (slot);
 
   WorkingMemory op;
@@ -234,18 +235,86 @@ TEST_CASE ("Alg24 maintenance charges each elapsed interval once",
   first.timestamp = 1000;
   OperationContext first_ctx (first, pctx, cfg);
   op.Execute (first_ctx, cortext::testing::GetNullTransaction ());
+  REQUIRE (pctx.wm_slots.front ().metadata_dirty);
+  REQUIRE_FALSE (pctx.wm_slots_dirty);
+
+  pctx.wm_slots.front ().metadata_dirty = false;
+  OperationContext same_time_ctx (first, pctx, cfg);
+  op.Execute (same_time_ctx, cortext::testing::GetNullTransaction ());
+  REQUIRE_FALSE (pctx.wm_slots.front ().metadata_dirty);
+  REQUIRE_FALSE (pctx.wm_slots_dirty);
 
   Signal second = first;
   second.timestamp = 2000;
   OperationContext second_ctx (second, pctx, cfg);
   op.Execute (second_ctx, cortext::testing::GetNullTransaction ());
+  REQUIRE (pctx.wm_slots.front ().metadata_dirty);
+  REQUIRE_FALSE (pctx.wm_slots_dirty);
 
   const double cost
       = core::WMMaintenanceCostPerSlot (cfg.sensitivity, cfg.focus);
   REQUIRE (pctx.wm_slots.front ().strength
            == Catch::Approx (2.0 - 2.0 * cost));
   REQUIRE (pctx.wm_slots.front ().last_ts == Catch::Approx (0.0));
   REQUIRE (pctx.wm_slots.front ().strength_ts == Catch::Approx (2.0));
+
+  pctx.wm_slots.front ().metadata_dirty = false;
+  Signal backward = second;
+  backward.timestamp = 1500;
+  OperationContext backward_ctx (backward, pctx, cfg);
+  op.Execute (backward_ctx, cortext::testing::GetNullTransaction ());
+  REQUIRE (pctx.wm_slots.front ().strength
+           == Catch::Approx (2.0 - 2.0 * cost));
+  REQUIRE_FALSE (pctx.wm_slots.front ().metadata_dirty);
+  REQUIRE_FALSE (pctx.wm_slots_dirty);
+}
+
+TEST_CASE ("Alg24 maintenance does not recharge below-floor slots without time",
+           "[operations][working_memory][maintenance][decay][regression]")
+{
+  SignalProcessor::Config prior_cfg;
+  cortext::testing::RequireEncoder (prior_cfg);
+  prior_cfg.focus = 1.0;
+  prior_cfg.sensitivity = 1.0;
+  prior_cfg.stability = 0.0;
+
+  SignalProcessor::Config current_cfg = prior_cfg;
+  current_cfg.focus = 0.0;
+  current_cfg.sensitivity = 0.0;
+  current_cfg.stability = 1.0;
+
+  const double prior_floor = core::WMStrengthFloor (
+      prior_cfg.focus, prior_cfg.sensitivity, prior_cfg.stability);
+  REQUIRE (prior_floor
+           < core::WMStrengthFloor (current_cfg.focus,
+                                    current_cfg.sensitivity,
+                                    current_cfg.stability));
+
+  ProcessorContext pctx;
+  ProcessorContext::WMSlot slot;
+  slot.embedding = Eigen::VectorXf::Ones (3);
+  slot.strength = prior_floor;
+  slot.last_ts = 2.0;
+  slot.strength_ts = 2.0;
+  slot.metadata_dirty = false;
+  pctx.wm_slots.push_back (slot);
+
+  WorkingMemory op;
+  Signal signal;
+  signal.embedding = slot.embedding;
+  signal.source_id = "test";
+  signal.timestamp = 2000;
+  OperationContext same_time_ctx (signal, pctx, current_cfg);
+  op.Execute (same_time_ctx, cortext::testing::GetNullTransaction ());
+  REQUIRE (pctx.wm_slots.front ().strength == Catch::Approx (prior_floor));
+  REQUIRE_FALSE (pctx.wm_slots.front ().metadata_dirty);
+
+  signal.timestamp = 1500;
+  OperationContext backward_ctx (signal, pctx, current_cfg);
+  op.Execute (backward_ctx, cortext::testing::GetNullTransaction ());
+  REQUIRE (pctx.wm_slots.front ().strength == Catch::Approx (prior_floor));
+  REQUIRE (pctx.wm_slots.front ().strength_ts == Catch::Approx (2.0));
+  REQUIRE_FALSE (pctx.wm_slots.front ().metadata_dirty);
 }
 
 TEST_CASE ("Alg24 uses Focus-derived gate_threshold for gating decision",
diff --git a/tests/state_persistence.test.cpp b/tests/state_persistence.test.cpp
