What this is

The OpenSpec change for the memory-core structural redesign — the follow-on to the audit + quick wins in #1568. Planning artifacts only (no production code): proposal, design, spec deltas, and a six-slice task breakdown. openspec validate: passing, 17 deltas.

Framing

The July 2026 audit (#1568, docs/research/memory-audit-2026-07.md) showed the memory system has lots of mechanism but no judgment (the semantic layers never functioned) and no metabolism (nothing is ever merged, expired, or deleted). This change adds both and subtracts the dead structure three redesign cycles left behind:

Add judgment

• memory-embeddings (new capability): in-process ONNX runtime (snowflake-arctic-embed 137M int8, CPU, zero sidecars), pinned hash-verified model allowlist with download-at-initialization, embed-on-write with derived backfill state, loud degradation (doctor + status + structured logs; lexical keeps serving, never silently).
• Write-side dedup becomes nominate-by-embedding → decide-by-LLM through one shared evaluator for both pipelines (May 2026 measured: no cosine threshold separates duplicates from siblings, so similarity never auto-merges).
• Read-side hybrid recall with an absolute cosine floor: turns where nothing is relevant inject nothing (the measured correct outcome for 65% of real queries).

Add metabolism

• Lossless merges: LLM-synthesized merged bodies validated by a deterministic MergeGuard with structural-append fallback; raw whole-body overwrite becomes unreachable.
• memory-maintenance (new capability): netclaw memory backfill-embeddings, ratified consolidation (dry-run plan files → operator-edited → backup-first apply), an expiry sweep that actually deletes (204/384 evidence records are currently expired-but-mummified), netclaw memory status.
• Trace revival: the 72-hour short-lived memory class gets a reachable producer, fresh-recall eligibility, and real deletion.
• Tool-use lesson memories: captured explicitly + by the sidecar, surfaced via per-tool context injection on first tool use per session.

Subtract

• BREAKING (semantic fix): searchable recall mode leaves the automatic recall pool; formation defaults new durable facts to searchable (breaks the measured 97%-auto monoculture at the source).
• The never-used hierarchical anchor-graph requirement is REMOVED (0 edges ever); facet inference (4 demo facets vs ~900 real) and the 95%-waste turn-complete checkpoint enqueue are retired.

Sequencing

Six independently-shippable slices (tasks.md): shared evaluator → embedding foundation → write-side nominate/decide → read-side hybrid → taxonomy/trace/lessons → maintenance + subtraction. Each slice carries its constitution gates; explicit measurement gate on ONNX query-embedding latency before the hybrid slice ships.

Relationship to other PRs

• memory: July 2026 audit + quick wins — revive curation LLM, balanced prompt, recall precision re-tune #1568 (audit + quick wins) supplies the evidence base and the gold sets used for calibration — merge it first so the referenced audit docs exist on dev.
• Implementation follows via /opsx-apply per slice after this change is reviewed.