Query space memory_v1

SQL queries run over the query space, memory_v1: a fixed set of prepared, read-only views and functions over your memory. Every statement is parsed and validated against it before it runs, and anything outside it is rejected. The views already apply the memory's rules — deleted versions, forgotten sources and superseded readings are absent — so a statement can only see what the memory itself would return.

This page is the reference for the query space: identity and versioning, the grammar a statement must follow, limits, the 12 functions, the 25 views and the 18 shipped saved queries. The routes that run statements are in SQL queries; a walkthrough is in Explore memory with SQL.

What describe_query_space tells an agent

Every call to describe_query_space (and GET /query/space) opens with this headline, word for word. It is the rule the rest of the query space is built around:

RememberStack has two deliberately separate truth layers. Claims are immutable source testimony (“what was asserted, by whom, when”); facts—relations and observations—are the adjudicated worldview (“what the system holds or held true”): supersession-adjudicated, clocked on two time axes (when a fact held in the world, and when the system learned it), evidence-counted per distinct source—repetition is not corroboration—and contradiction-tracked. The fact_claim_evidence association is the auditable bridge between the layers, recording which claims support or contradict each fact. Query claims to inspect testimony; query facts to answer current or historical truth questions, then follow the bridge to see why the system believes or believed the fact.

(Internally these guarantees are decisions D41 and D54.)

Version and manifest hash

The query space is described by a manifest checked into the engine. Its hash covers the views (definitions, columns, comments), the function signatures, the assured operation descriptors and the limits. Every QueryResult reports it in surface_manifest_hash, and GET /query/space returns the whole manifest content.

When a release changes the query space, the hash changes. The deployment then moves every active saved query to pending_revalidation, and a saved query refuses to run (saved_query_revalidation_pending) until it is revalidated against the new hash. If the database's live views do not match the manifest the server was built with, every statement fails with schema_version_mismatch.

What a statement may contain

A statement is checked in this order. The first rule it breaks decides the error code.

One read-only statement

• Exactly one statement (multiple_statements otherwise).
• It must be a SELECT, VALUES or WITH … SELECT (statement_not_allowed). No SELECT INTO, no FOR UPDATE or other row locks, no TABLESAMPLE.
• It must parse as PostgreSQL (parse_error) and contain no NUL byte.
• Names beginning with __rememberstack_ are reserved (statement_not_allowed).
• Placeholders must be contiguous from $1 (invalid_parameter), and the request must supply exactly as many parameters as the highest placeholder.

Relations

A statement may read only the 25 views below, unqualified or as memory_v1.<view>, and its own CTEs. Any other table, view or schema is relation_not_allowed.

Built-in functions

Besides the 12 public functions, these built-in functions are allowed (function_not_allowed otherwise). A pg_catalog. prefix is allowed; any other schema prefix is not.

Also refused: ordered-set aggregates (WITHIN GROUP), table functions (XMLTABLE, JSON_TABLE), XML expressions, and session keywords such as CURRENT_USER and CURRENT_SCHEMA.

Operators

=, <>, !=, <, <=, >, >=, +, -, *, /, %, ||, @>, <@, &&, ->, ->>, #>, #>>, ~, ~*, !~, !~*, LIKE (~~), NOT LIKE (!~~), ILIKE (~~*), NOT ILIKE (!~~*), = ANY, BETWEEN, NOT BETWEEN. AND, OR, NOT, IS NULL and IS [NOT] TRUE/FALSE are allowed too. Any other operator, including one in ORDER BY … USING, is operator_not_allowed.

Casts

Casts are allowed only to uuid, text, varchar, bpchar, bool, boolean, int2, int4, int8, integer, bigint, smallint, numeric, float4, float8, timestamptz, timestamp, date, interval, jsonb (operator_not_allowed otherwise).

Syntax

The statement is built from a fixed set of syntax elements; anything else is statement_not_allowed. Allowed: SELECT with FROM, joins, subqueries in FROM and in expressions (IN, EXISTS, scalar), WITH, WHERE, GROUP BY (including grouping sets), HAVING, ORDER BY, LIMIT, window definitions, CASE, COALESCE, GREATEST/LEAST, NULL and boolean tests, array constructors and subscripts, row constructors, COLLATE, named function arguments, and literals of every kind. The exact parser classes are listed in GET /query/space under sql_grammar.statement_node_classes.

Recursion

At most one recursive CTE per statement, and it must follow one template (unbounded_recursion otherwise):

• the WITH RECURSIVE clause holds exactly one CTE, with no CYCLE or SEARCH clause;
• its body is anchor UNION [ALL] recursive-term;
• the anchor sets an integer column named depth to the literal 0;
• the recursive term references the CTE exactly once, joins only views (no subqueries in its FROM), and emits depth + 1 in the depth column;
• the recursive term has a top-level condition depth < N with N at most 6, not inside an OR.

WITH RECURSIVE reach AS (
  SELECT object_entity_id AS entity_id, 0 AS depth
  FROM graph_edges_current
  WHERE subject_entity_id = $1::uuid
  UNION
  SELECT e.object_entity_id, r.depth + 1
  FROM reach AS r
  JOIN graph_edges_current AS e ON e.subject_entity_id = r.entity_id
  WHERE r.depth < 3
)
SELECT DISTINCT entity_id FROM reach

Public function placement

The 12 public functions return rows, and they have extra rules (function_placement_not_allowed otherwise):

• a call must be a FROM item of the top-level statement, or of a top-level CTE body — not inside a subquery, a UNION arm, a LATERAL join or an IN/EXISTS test;
• each call is its own FROM item (no ROWS FROM with several functions);
• every argument is a literal or a parameter ($1), optionally cast;
• at most 3 calls per category per statement (quota_exceeded): nomination (semantic_*, lexical_*), body fetch (fetch_chunk_bodies), bitemporal (facts_as_of), temporal (canonical_bounds), graph (graph_*).

Limits

Two limit tiers exist. Over HTTP, every statement runs in the interactive tier. The analytical tier needs an operator entitlement and a separate pool that the shipped profile does not configure, so it is listed for completeness.

A caller may lower a limit, or raise it up to the hard cap. Over HTTP only max_rows can be set by the caller; a saved query can also carry its own statement_timeout_ms and max_bytes defaults.

Rows beyond the row cap, or beyond the byte cap, are cut and the result says truncated: true with truncation_reason row_cap or byte_cap. Exceeding a concurrency or per-minute budget refuses the statement with concurrency_exceeded or quota_exceeded.

Every statement runs in one read-only, repeatable-read transaction with parallel query off, so all its parts see one snapshot of the memory.

Per-function caps, in addition:

Functions

The 12 public functions are set-returning: call them in FROM, following the placement rules. The search functions nominate candidates from the search index and then confirm each one against the database inside the same transaction, so a result never includes something the views would hide. What they did is reported in the result's semantic_invocations or graph_invocations.

now() and other clock functions are not allowed. Pass the time you mean as a parameter.

semantic_claims

semantic_claims(query text, k integer [, filters jsonb [, embedding_input_policy_version text [, embedder_generation text]]])

Claims ranked by meaning. Category: nomination.

Filters: asserted_from, asserted_to (ISO 8601 instants), doc_id, entity_id (UUIDs), source_kind (string).

lexical_claims

lexical_claims(query text, k integer [, filters jsonb])

Claims ranked by keyword (BM25). Same columns and filters as semantic_claims. Category: nomination.

semantic_chunks

semantic_chunks(query text, k integer [, filters jsonb [, embedding_input_policy_version text [, embedder_generation text]]])

Source chunks ranked by meaning. Category: nomination.

Filters: doc_id (UUID), language, section_role, source_kind, source_shape (strings). section_role must be one of body, abstract, introduction, results, methods, discussion, conclusion, references, appendix, table, figure_caption, nav, boilerplate, legal.

lexical_chunks

lexical_chunks(query text, k integer [, filters jsonb])

Source chunks ranked by keyword (BM25). Same columns and filters as semantic_chunks. Category: nomination.

semantic_facts

semantic_facts(query text, k integer [, filters jsonb [, embedding_input_policy_version text [, embedder_generation text]]])

Facts (relations and observations) ranked by meaning. Category: nomination.

Filters: fact_kind (relation or observation), support_state (current or withdrawn), predicate (string), subject_entity_id, object_entity_id (UUIDs).

semantic_entities

semantic_entities(query text, k integer [, filters jsonb])

Entities ranked by how well their profile matches. No filters. Category: nomination.

For all six search functions: filters is a JSON object with scalar values from the function's filter list; any other key is invalid_parameter. The two generation arguments pin a specific embedding generation and are normally left out.

fetch_chunk_bodies

fetch_chunk_bodies(chunk_ids uuid[])

The text of up to 50 chunks, re-verified against their content and embedding hashes before it is returned. All requested chunks must belong to one embedding generation. Category: body fetch.

chunks_live has no text column; this function is the only way to read chunk text in SQL.

facts_as_of

facts_as_of(valid_at timestamptz, believed_at timestamptz [, max_rows integer])

The facts that were valid at valid_at, as the memory believed at believed_at. max_rows defaults to 200, hard cap 1,000. Category: bitemporal.

canonical_bounds

canonical_bounds(valid_from timestamptz, valid_until timestamptz, valid_precision text)

Turn a stored validity window and its precision into the half-open interval it means: a day covers the whole UTC day, a year the whole year, an instant a one-microsecond point; open has no end and unknown has no bounds. Category: temporal.

Because arguments must be literals or parameters, use it for one window you supply. For every claim at once, read claims_canonical, which carries the same bounds.

graph_neighborhood

graph_neighborhood(deployment_id uuid, start_entity_id uuid
  [, max_depth integer [, predicates text[] [, valid_at timestamptz [, believed_at timestamptz
  [, max_results integer [, expansion_budget integer [, frontier_budget integer [, time_budget_ms integer]]]]]]]])

Paths to the entities within max_depth hops, and one terminal status row. Category: graph.

graph_path

graph_path(deployment_id uuid, from_entity_id uuid, to_entity_id uuid
  [, max_depth integer [, predicates text[] [, valid_at timestamptz [, believed_at timestamptz
  [, max_results integer [, expansion_budget integer [, frontier_budget integer [, time_budget_ms integer]]]]]]]])

Equal-length shortest paths between two entities, and one terminal status row. Same columns as graph_neighborhood. Category: graph.

graph_citation_path

graph_citation_path(deployment_id uuid, from_doc_id uuid, to_doc_id uuid
  [, max_depth integer [, max_paths integer [, expansion_budget integer [, frontier_budget integer [, time_budget_ms integer]]]]])

Directed citation chains between two live documents, and one terminal status row. Category: graph.

For all three graph functions:

• the first argument must be the parameter $1, bound to this deployment's id (invalid_parameter otherwise). Every QueryResult reports that id in deployment_id;
• the statement timeout is 5 seconds;
• the terminal status row is removed from rows and reported in graph_invocations; a budget that was reached also appears in warnings and truncation_reason.

SELECT hops, relation_ids, node_ids
FROM graph_neighborhood($1::uuid, $2::uuid, 2)
ORDER BY hops, relation_ids

Views

The 25 views, with every column. Descriptions are the comments in the manifest, as GET /query/space returns them. Every view has a deployment_id column; a deployment only ever sees its own rows.

changes_visible

One row per externally visible change event, keyed by the synthetic pair (deployment_id, object_kind, event_id): every union arm names its own transition in object_kind and supplies an identifier from its own source table, so the underlying identifier spaces cannot collide. Each arm reads an already invariant-bearing relation or joins one, so a change event appears only while its object is still visible. THERE IS DELIBERATELY NO DELETION ARM: forgetting a lineage, tombstoning a version, or retiring a page removes the affected events instead of announcing the removal, and labels are drawn only from visible objects, so neither the event set nor the label text can become a side channel for what was forgotten. The occurrence clock is transaction time and never world validity, the feed is uncapped at the relation level so a caller bounds it with an ordinary predicate, and the view carries no counts and asserts no facts.

• Grain: one externally visible change event (change_event_visible)
• Row key: deployment_id, object_kind, event_id
• Clock semantics: transaction_time_event
• Joins to: facts_visible_history on deployment_id, object_id; claims_visible_history on deployment_id, object_id; pages_live on deployment_id, object_id

chunks_live

One row per chunk coordinate in the current ready representation of a live lineage, keyed by (deployment_id, chunk_id) and joined to documents_live on (deployment_id, doc_id) and to sections_live on (deployment_id, section_id). This relation is metadata only and deliberately carries no authoritative body column: chunk text is returned solely by the confirmed body-fetch path, which re-verifies the coordinate and the content and embedding hashes before any bytes leave the system. Chunks of superseded versions, non-ready readings, and forgotten lineages are absent, and a section_id is exposed only when that section belongs to the representation's current structure generation. The location header is generated orientation text, never evidence; the view carries no counts and no validity clocks.

• Grain: one chunk coordinate in a current ready representation (chunk_current_content)
• Row key: deployment_id, chunk_id
• Clock semantics: none
• Joins to: documents_live on deployment_id, doc_id; document_versions_visible on deployment_id, version_id; sections_live on deployment_id, section_id

claim_occurrences_live

One row per current claim occurrence, keyed by (deployment_id, claim_id, chunk_id, derivation_kind) with null derivation kinds treated as equal, and joined to claims_visible_history on (deployment_id, claim_id) and to chunks_live on (deployment_id, chunk_id). It is the explicit association answering which current chunk, version, representation, and section carry a claim, and evidence_spans is the complete body support for that occurrence. Repeated attachments collapse to the earliest, so attached_at is the first time the occurrence was recorded. Occurrences in superseded versions, non-ready readings, and forgotten lineages are absent. Claim char_start/char_end remain the immutable origin; they are not the complete evidence list. The view carries no counts and no validity clocks.

• Grain: one current claim occurrence (claim_occurrence_current_content)
• Row key: deployment_id, claim_id, chunk_id, derivation_kind
• Clock semantics: none
• Joins to: claims_visible_history on deployment_id, claim_id; chunks_live on deployment_id, chunk_id

claims_canonical

One row per historically visible claim with surviving lineage, keyed by (deployment_id, claim_id), carrying the stored inclusive D41 window beside the half-open canonical bounds that every overlap predicate must use (D107 §5). canon_start is inclusive and canon_end exclusive; both are null when precision is unknown, and canon_end is also null for an open window. Overlap is a.start < b.end AND b.start < a.end with a null end as unbounded. This relation is IMMUTABLE SOURCE TESTIMONY: it never answers what currently holds. Claims of forgotten lineages and tombstoned versions are absent.

• Grain: one historically visible claim with surviving lineage and its half-open canonical window (claim_visible_history_canonical)
• Row key: deployment_id, claim_id
• Clock semantics: claim_validity_immutable
• Joins to: documents_live on deployment_id, doc_id; document_versions_visible on deployment_id, version_id

claims_live

One row per current-testimony claim, keyed by (deployment_id, claim_id): the subset of claims_visible_history whose D54 currency flag is still set. Like every claim relation this is IMMUTABLE SOURCE TESTIMONY, and "live" here means current transcription of a live source, never current truth: a claim in this relation can be contradicted by the adjudicated worldview, and querying its validity window to answer what holds now is the wrong query — start from facts_current and follow fact_claim_evidence_live back to here. The stored claim_valid_* window is inclusive D41 storage; world-time overlap belongs on claims_canonical. Claims of forgotten lineages and tombstoned versions are absent, and this relation is the sole claim input to the D54 counting path. The view carries no counts.

• Grain: one current-testimony claim (claim_current_testimony)
• Row key: deployment_id, claim_id
• Clock semantics: claim_validity_immutable
• Joins to: documents_live on deployment_id, doc_id; document_versions_visible on deployment_id, version_id

claims_visible_history

One row per claim whose source lineage is live and whose source version is not tombstoned, keyed by (deployment_id, claim_id) and joined to documents_live on (deployment_id, doc_id) and to document_versions_visible on (deployment_id, version_id). This relation is IMMUTABLE SOURCE TESTIMONY and never answers what currently holds: claim_valid_from and claim_valid_until are the inclusive stored D41 window (an instant has equal endpoints). World-time overlap MUST use claims_canonical.canon_start / canon_end, which are the half-open canonical bounds; filtering these raw columns as a current-truth or overlap predicate is the wrong query — use facts_current for what holds now, and claims_canonical for as-of testimony. A null claim_valid_from means unbounded-before or unknown and a null claim_valid_until means open-per-source or unknown, disambiguated by claim_valid_precision. Claims of forgotten lineages and tombstoned versions are absent; is_current_testimony is D54 bookkeeping and never validity. The view carries no counts.

• Grain: one historically visible claim with surviving lineage (claim_visible_history)
• Row key: deployment_id, claim_id
• Clock semantics: claim_validity_immutable
• Joins to: documents_live on deployment_id, doc_id; document_versions_visible on deployment_id, version_id

contradiction_members_current

One row per current member of a contradiction group, keyed by (deployment_id, contradiction_group, fact_kind, fact_id) and joined to facts_current on (deployment_id, fact_kind, fact_id). A contradiction group is the system declining to silently pick a winner, so both sides stand and are visible here with their own clocks, counts, and support state. Membership, clocks, and the shared evaluation instant are inherited unchanged from facts_current, including the half-open world-time interval and the surviving-provenance requirement. Because arbitrary SQL can still filter this relation down to one side, a result built from it carries no platform guarantee that co-members are complete: that guarantee belongs to the assured operations. The counts are exact counts of distinct current-testimony lineages, and support state is derived at read time.

• Grain: one current contradiction-group member (contradiction_member_current)
• Row key: deployment_id, contradiction_group, fact_kind, fact_id
• Clock semantics: bitemporal_current_at_evaluated_at
• Joins to: facts_current on deployment_id, fact_kind, fact_id

document_crossrefs_live

One row per resolved cross-reference whose BOTH endpoint lineages are live, keyed by (deployment_id, crossref_id) and joined to documents_live on (deployment_id, from_doc_id) and (deployment_id, to_doc_id). An unresolved reference, a reference whose target was never ingested, or one whose source or target lineage has been forgotten is absent rather than half-resolved, so this relation never reveals that a document once existed. The raw citation text is deliberately not exposed, because it is retained even after a target is forgotten; the bounded context is truncated to 500 characters. The creation clock is a processing instant, and the view carries no counts and asserts no facts.

• Grain: one live document cross-reference (document_crossref_live)
• Row key: deployment_id, crossref_id
• Clock semantics: none
• Joins to: documents_live on deployment_id, from_doc_id; documents_live on deployment_id, to_doc_id

document_versions_visible

One row per non-tombstoned version of a live document lineage, keyed by (deployment_id, version_id) and joined to documents_live on (deployment_id, doc_id). A tombstoned version and every version of a forgotten lineage are absent, which is why the whole schema authorizes version-derived rows through this relation rather than through document_versions directly. This is version history, not fact history: is_current_version says which snapshot the lineage currently points at, and no column here asserts what the system currently believes to be true. The view carries no counts.

• Grain: one visible version of a live lineage (document_version_visible)
• Row key: deployment_id, version_id
• Clock semantics: ingest_and_supersession_instants
• Joins to: documents_live on deployment_id, doc_id

documents_live

One row per live document lineage, keyed by (deployment_id, doc_id). A tombstoned lineage is absent, and the current version and representation coordinates are produced only from a non-tombstoned version and a ready representation, so no column can name deleted state. The two optional joins project coordinates of an already authorized lineage and admit no row of their own. This is a live-content relation, not a fact or evidence relation: title and source metadata are orientation, never asserted evidence, and the view carries no counts and no clock semantics beyond the observation instants it names.

• Grain: one live document lineage (document_lineage_live)
• Row key: deployment_id, doc_id
• Clock semantics: source_observation_instants

entities_current

One row per externally visible survivor entity, keyed by (deployment_id, entity_id). Membership requires SURVIVING PROVENANCE, which is an explicit association to at least one live document lineage: a mention of this survivor in any non-tombstoned version of a live lineage, or a live document-entity bridge. An entity whose every source has been forgotten is therefore absent rather than orphaned, and merged entities are absent because a merge redirects to a survivor instead of rewriting history. MEMBERSHIP AND THE COUNTS ANSWER DIFFERENT QUESTIONS, and the difference is deliberate: the two counts are exact over CURRENT content only — they equal this entity's rows in mentions_live and entity_document_mentions — so an entity whose only mention sits in a superseded version of a live lineage is published here with both counts at zero and has no row in entity_document_mentions at all. A zero count is not an absence of provenance. graph_degree is a deprecated compatibility scalar fixed at zero after D98 because current adjacency is computed from live PostgreSQL relations; profile_summary is orientation text, never evidence; and the clocks are registry maintenance instants that carry no world-validity meaning. After D96, entity_type and type_confidence are vacated (always NULL); identity is the entity_id.

• Grain: one externally visible survivor entity (entity_survivor_current)
• Row key: deployment_id, entity_id
• Clock semantics: registry_maintenance_instants

entity_aliases_current

One row per current alias-to-survivor mapping, keyed by (deployment_id, alias_id) and joined to entities_current on (deployment_id, entity_id). Merge redirects are resolved, so an alias recorded against a since-merged entity now names the survivor while source_entity_id preserves where it was recorded. An alias whose survivor has no surviving provenance is absent, because membership is inherited from entities_current. The clocks are observation instants rather than validity, and the view carries no counts.

• Grain: one current alias-to-survivor mapping (entity_alias_current)
• Row key: deployment_id, alias_id
• Clock semantics: observation_instants
• Joins to: entities_current on deployment_id, entity_id

entity_document_mentions

One row per survivor entity and live document lineage, keyed by (deployment_id, entity_id, doc_id) and joined to entities_current on (deployment_id, entity_id) and documents_live on (deployment_id, doc_id). The mention count is EXACT rather than sampled or capped, and it counts exactly the mentions this deployment can still show: one for every row of mentions_live in this lineage whose resolution names this survivor, and nothing else. Mentions of forgotten lineages, mentions of superseded versions and non-current readings, mentions with no chunk coordinate, mentions whose own lineage disagrees with their chunk's, and mentions whose resolution has been superseded are therefore counted nowhere — a mention of superseded content is not live content and is not counted. Merge redirects are resolved before counting, so a merged entity contributes to its survivor and never appears on its own. The clocks are mention-recording instants, not world-validity, and this relation carries no evidence and no fact semantics.

• Grain: one survivor entity × live document (entity_document_mention_live)
• Row key: deployment_id, entity_id, doc_id
• Clock semantics: mention_observation_instants
• Joins to: entities_current on deployment_id, entity_id; documents_live on deployment_id, doc_id

evidence_lineage

One row per fact, current-testimony document lineage, and stance, keyed by (deployment_id, fact_kind, fact_id, doc_id, stance) and joined to the fact relations on (deployment_id, fact_kind, fact_id) and to documents_live on (deployment_id, doc_id). THIS RELATION IS THE SOLE PUBLIC INPUT FOR D54 EVIDENCE COUNTS: an evidence count is the number of rows here for a fact and stance, which is exactly the number of distinct current-testimony source lineages, so repeating an assertion inside one document and re-extracting the same document both leave every count unchanged while a genuinely independent second source moves it by one. claim_count is descriptive colour about how loudly one lineage says it and must never be summed into an evidence count. Evidence from forgotten lineages and from superseded testimony is absent. The assertion range is source-asserted event time, not fact validity.

• Grain: one fact × current-testimony document lineage × stance (evidence_lineage)
• Row key: deployment_id, fact_kind, fact_id, doc_id, stance
• Clock semantics: assertion_event_range
• Joins to: facts_visible_history on deployment_id, fact_kind, fact_id; documents_live on deployment_id, doc_id; claims_live on deployment_id, representative_claim_id

fact_claim_evidence_live

One row per current claim-to-fact association, keyed by (deployment_id, fact_kind, fact_id, claim_id, stance) and joined to facts_current or facts_visible_history on (deployment_id, fact_kind, fact_id) and to claims_live on (deployment_id, claim_id). This is the AUDITABLE BRIDGE between the two truth layers: it records which immutable testimony supports or contradicts an adjudicated fact, and stance is exactly supports or contradicts. Only current testimony from live lineages appears, and an association whose denormalized lineage disagrees with its claim's lineage is treated as mismatched state and dropped rather than exposed. The claim-validity columns are the SOURCE's asserted interval, inclusive at both endpoints and never the fact's validity; a null endpoint is unbounded or unknown. The view carries no counts: aggregate evidence_lineage instead.

• Grain: one current claim-to-fact association (fact_claim_evidence_live)
• Row key: deployment_id, fact_kind, fact_id, claim_id, stance
• Clock semantics: claim_validity_immutable
• Joins to: facts_visible_history on deployment_id, fact_kind, fact_id; claims_live on deployment_id, claim_id; documents_live on deployment_id, doc_id

facts_current

Confirmed facts holding at the single evaluated_at instant and still believed. Unknown or partial windows are excluded from this strict current view; inspect facts_visible_history for possible matches and historical achievements. A NULL end alone never establishes ongoing validity. Counts are distinct current testimony lineages.

• Grain: one currently valid relation or observation (fact_current)
• Row key: deployment_id, fact_kind, fact_id
• Clock semantics: bitemporal_current_at_evaluated_at
• Joins to: entities_current on deployment_id, subject_entity_id; entities_current on deployment_id, object_entity_id; fact_claim_evidence_live on deployment_id, fact_kind, fact_id

facts_visible_history

Historically visible adjudicated facts with one canonical world window and separate system timestamps. Membership requires surviving provenance. Unknown dates and partial windows are possible temporal matches, not proof of being current; open precision explicitly means ongoing. Completed windows remain believed history while invalidated_at is NULL. Evidence counts and support state are current testimony, not reconstructed historical counts.

• Grain: one historically visible relation or observation (fact_visible_history)
• Row key: deployment_id, fact_kind, fact_id
• Clock semantics: bitemporal_raw
• Joins to: entities_current on deployment_id, subject_entity_id; entities_current on deployment_id, object_entity_id; evidence_lineage on deployment_id, fact_kind, fact_id

graph_edges_current

One row per current relation edge, keyed by (deployment_id, relation_id) and joined to entities_current on (deployment_id, subject_entity_id) and (deployment_id, object_entity_id). This is the LIVE graph surface, evaluated in PostgreSQL rather than read from a projection: it inherits the facts_current membership rule, the same half-open world-time interval, and the same shared evaluation instant, which is emitted on every row. Both endpoints are survivor identities and both are required to be visible entities, so an edge is dropped as a unit rather than dangling into an entity that has no surviving provenance. The counts are exact counts of distinct current-testimony lineages, and support state is derived at read time from the open review queue. Observations never project here, because they are entity-anchored facts rather than edges.

• Grain: one current relation edge (graph_edge_current)
• Row key: deployment_id, relation_id
• Clock semantics: bitemporal_current_at_evaluated_at
• Joins to: entities_current on deployment_id, subject_entity_id; entities_current on deployment_id, object_entity_id

graph_edges_visible_history

One row per historically visible relation edge, keyed by (deployment_id, relation_id) and joined to entities_current on both endpoint columns. Membership requires surviving historical provenance and two visible survivor endpoints, so a relation whose sources have all been forgotten disappears and an edge is never left dangling. Both clocks are RAW: world time is half-open, transaction time is bounded by ingested_at and invalidated_at, a null endpoint is unbounded or unknown, and membership here is not a claim that the edge currently holds. The three columns suffixed _current are LIVE CURRENT-TESTIMONY VALUES READ NOW and never assert that those counts or that support state held at any historical instant; they come from evidence_lineage and from the open support_withdrawn review row respectively.

• Grain: one historically visible relation edge (graph_edge_visible_history)
• Row key: deployment_id, relation_id
• Clock semantics: bitemporal_raw
• Joins to: entities_current on deployment_id, subject_entity_id; entities_current on deployment_id, object_entity_id

identity_events_visible

One row per visible identity event, keyed by the synthetic pair (deployment_id, object_kind, event_id): each union arm names its own log in object_kind and supplies that log's own identifier, so the two identifier spaces cannot collide. Resolution events carry a mention and an outcome of linked or new_entity; they appear only while that exact mention is present in mentions_live, which binds them to the current-content transcript and its complete visibility gate. Merge events carry a counterpart entity and an outcome of merge or unmerge, where a split is recorded as the un-merge that reversed a merge. Every event requires its survivor entity to pass the entities_current provenance gate. Decision clocks are transaction time and carry no world-validity meaning; the view carries no counts and asserts no facts.

• Grain: one visible resolution/merge/split event (identity_event_visible)
• Row key: deployment_id, object_kind, event_id
• Clock semantics: transaction_time_event
• Joins to: entities_current on deployment_id, entity_id; mentions_live on deployment_id, mention_id

mentions_live

One row per mention occurring in current content, keyed by (deployment_id, mention_id) and joined to chunks_live on (deployment_id, chunk_id), documents_live on (deployment_id, doc_id), and entities_current on (deployment_id, resolved_entity_id). Membership binds every coordinate of the mention: the chunk must be a current-content chunk and the mention's own lineage must be that chunk's lineage, so mentions in superseded versions, in non-ready readings, in forgotten lineages, and mentions whose recorded lineage disagrees with their chunk's are all absent. Resolution is deliberately nullable and UNRESOLVED MENTIONS REMAIN VISIBLE: the five resolution columns are populated together or not at all, from the mention's single live, unsuperseded decision and only when the survivor that decision names passes the entities_current provenance gate, so a decision pointing at a retired, merged-away, or provenance-free identity leaves the whole resolution null rather than describing a decision whose subject this schema will not show. The claim coordinate is gated the same way and is null unless that claim is itself a visible claim of this lineage. Merge redirects are resolved before exposure. This relation is source transcript, not evidence and not fact; it carries no counts and no validity clocks. After D96, emitted_type and type_confidence are vacated compatibility positions that always return NULL.

• Grain: one mention in current content (mention_current_content)
• Row key: deployment_id, mention_id
• Clock semantics: none
• Joins to: documents_live on deployment_id, doc_id; chunks_live on deployment_id, chunk_id; entities_current on deployment_id, resolved_entity_id; claims_visible_history on deployment_id, claim_id

page_evidence_visible

One row per visible artifact-to-target citation, keyed by (deployment_id, artifact_id, role, target_kind, target_id) and joinable to pages_live on (deployment_id, artifact_id), documents_live on target_id for claim and document targets, and the fact relations on target_id for relation targets. EACH TARGET PASSES ITS OWN VISIBILITY GATE: a citation appears only while its cited lineage is live or its cited relation still has surviving provenance, so forgetting a source removes the link rather than leaving a reference to vanished content. The authoritative citation set is evaluated once and joined directly to non-tombstoned artifact status, which is exactly the membership rule pages_live applies, so a visible page always has at least one row here and a link never outlives the page that carries it. A claim citation is a stable coordinate on the asserting LINEAGE, and its chunk content hashes are exposed only as locators inside that already authorized lineage: the hash never authorizes a read and cannot be used to bypass the lineage gate. Because several chunk coordinates in one lineage collapse into one association, link_count reports exactly how many underlying links were collapsed. The view carries no clocks.

• Grain: one visible K artifact-to-target association (k_artifact_evidence_visible)
• Row key: deployment_id, artifact_id, role, target_kind, target_id
• Clock semantics: none
• Joins to: pages_live on deployment_id, artifact_id; documents_live on deployment_id, target_id; facts_visible_history on deployment_id, target_id

pages_live

One row per visible knowledge artifact, keyed by (deployment_id, artifact_id) and joined to page_evidence_visible on the same pair. Membership is FAIL-CLOSED ON PROVENANCE as well as on status: an artifact appears only while it is not tombstoned AND at least one of its citations still points at a visible target, so a page whose every cited source has been forgotten leaves with them instead of surviving as compiled prose about content this deployment can no longer show. Both page kinds carry citations, so an artifact with none is anomalous rather than ordinary: it is absent here and counted in the operator quarantine report, where it can be recompiled or retired. A tombstoned parent, and a parent that is itself absent for either reason, is reported as null rather than dangling. Everything textual here is COMPILED ORIENTATION PROSE AT COMPILED GRAIN: page_summary is a writer's abstract of cited evidence and can never be promoted to a live fact, and the artifact body itself lives in the knowledge repository rather than in this schema. The review-flag count is exact over unprocessed flags, is_stale means the compiled page is known to lag its inputs, and last_compiled_at is a processing instant rather than a validity clock.

• Grain: one visible K artifact (k_artifact_compiled_grain)
• Row key: deployment_id, artifact_id
• Clock semantics: compilation_instants
• Joins to: pages_live on deployment_id, parent_artifact_id

sections_live

One row per section of the current ready representation of a live lineage, keyed by (deployment_id, section_id) and joined to documents_live on (deployment_id, doc_id). Sections of a superseded version, of a non-ready reading, of a superseded D79 structure generation, and of a forgotten lineage are all absent, so a node_path resolves to exactly one live tree. Character and block offsets are meaningful only against the named representation. The summary column is orientation text, not evidence, and the view carries no counts and no validity clocks.

• Grain: one section in a current ready representation (section_current_content)
• Row key: deployment_id, section_id
• Clock semantics: none
• Joins to: documents_live on deployment_id, doc_id; document_versions_visible on deployment_id, version_id

testimony_currency_events_visible

One row per visible D54 testimony-currency transition, keyed by (deployment_id, event_id) and joined to claims_visible_history on (deployment_id, claim_id) and to documents_live on (deployment_id, doc_id). A currency transition is BOOKKEEPING and never validity: nothing about the claim changes and no fact is adjudicated by it. Transitions of forgotten lineages and of claims whose source version is tombstoned are absent, and from_version_id is null rather than dangling whenever the superseded version is itself no longer visible, so this relation cannot be read as a tombstone side channel. The occurrence instant is transaction time; the view carries no counts and no world-validity clocks.

• Grain: one visible D54 transition (testimony_currency_event_visible)
• Row key: deployment_id, event_id
• Clock semantics: transaction_time_event
• Joins to: documents_live on deployment_id, doc_id; claims_visible_history on deployment_id, claim_id; document_versions_visible on deployment_id, from_version_id

Shipped saved queries

Every deployment is seeded with 18 saved queries in the examples namespace, status active, origin and assurance shipped_example. They are starting points, not guarantees: RememberStack wrote them and they pass the same validation as your statements, but what they compute is plain SQL you can read (GET /query/saved/examples/<name>), copy and change. A copy is yours.

Their parameter_schema is empty. The parameters are the positional placeholders in the SQL, listed here. Run one with POST /query/saved/examples/<name>/run and {"parameters": [...]}.

The examples namespace belongs to the platform: seeding refuses to overwrite a query of yours with the same name, and never re-enables a shipped query you disabled. Copies you make must use another namespace.

curl -s -X POST "$REMEMBER_API_URL/query/saved/examples/changed_since/run" \
  -H "Authorization: Bearer $REMEMBER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"parameters": ["2026-09-20T00:00:00Z"]}'

from remember import Client
 
memory = Client()
result = memory.run_saved_query(
    namespace="examples", name="changed_since", parameters=["2026-09-20T00:00:00Z"]
)
for object_kind, object_id, occurred_at, label in result["rows"]:
    print(occurred_at, object_kind, label)