fix(mem0): reset() proves the namespace is writable, never sleeps

[YinkaMetrics]

Summary

reset() no longer treats "the namespace reads empty" as proof the delete_all finished. When it actually deleted, it proves the namespace accepts writes again before returning: write a sentinel, poll for it, delete it, return.

• Only on the delete path. The skip path — namespace already empty, the common case — is untouched and still costs nothing.
• Raises if the namespace never accepts a write within the timeout, rather than starting a scenario whose first facts would be swallowed.
• No blanket settle added, per instruction.

⚠️ Invariant 9

This can convert phantom missing_current_fact FAILs into passes — the guarded direction. It was founder-instructed, which is the sign-off invariant 9 requires before merge, and the HANDOFF.md entry records that.

The good-faith test named in the invariant holds: a genuine finding survives untouched. The sentinel only proves the namespace accepts writes again, and is deleted before any scenario value is written. Nothing about retrieval, supersession, scoping or deletion behaviour is affected.

One deliberate refinement of the brief

The brief said: write a sentinel, poll, raise if it never lands. Implemented as a bounded retry loop instead.

A single-shot sentinel is wrong in exactly the case it exists for: a write swallowed by the still-reaping delete_all never becomes retrievable however long it is polled. Polling harder cannot help; only writing again can. So a single-shot sentinel would abort runs that a second attempt moments later would have saved — trading a phantom FAIL for a phantom abort.

Each attempt gets 5s (_SENTINEL_ATTEMPT_TIMEOUT); the loop is bounded by the 30s _CONVERGE_TIMEOUT, so it cannot hang. Attempt count is recorded and logged.

Say if you want the strict single-shot version — it's a two-line change.

The measurement series, free on every run

Each deleting reset appends to adapter.reset_convergence and prints:

  [reset] mc_ns: namespace read empty after 2.5s, writable 1.5s later (2 sentinel attempt(s))

empty_to_writable_s is the number nobody has had: how long a delete_all keeps reaping after it stops being visible to search. One value is an anecdote; a run produces one per deleting reset, and the distribution is the real characterisation.

This makes arms (f)/(g) a confirmation rather than the only source — and it collects data on runs that pass, not just ones that break.

Tests: 67 → 71

Against a ReapingClient whose delete_all arms a window of swallowed writes after the namespace already reads empty — the measured 6/14 behaviour:

• the sentinel absorbs the reaping window, so the scenario's first real write survives (without it, that write vanishes and is scored as a missing fact);
• no sentinel is left behind;
• the gap is recorded on the delete path and not on the skip path;
• reset raises rather than starting against an unwritable namespace.

Building these caught a defect in my first fake client: it armed reaping from construction rather than from delete_all, which isn't the condition — reaping is a consequence of the delete. Fixed before it could validate the wrong thing.

Two details worth reviewing

Sentinel cleanup uses a per-key delete by id, never a delete_all, so cleanup cannot restart the condition it just cleared. Arms (a)–(c) measured per-key delete followed by immediate write landing at 0s, three for three — that's the evidence for the choice.

Residual risk, stated: a sentinel landing after cleanup would persist. It sits under a tenant/user pair no scenario maps onto, so no scenario query can retrieve it, and the next reset() removes it. It would make the namespace read non-empty, turning a future skip-path reset into a delete-path one. Bounded and self-healing, but real.

Verification

• pytest -q: 71 passed, 4 skipped
• memorycheck run scenarios --adapter reference:strict --fail-on p2: PASS

What this does not do

It does not close the 012/003 question. It removes one harness-side mechanism by which a run can be killed or a provider mis-scored. Whether the aborts were that mechanism is still open — but the next run will now measure the gap rather than guess at it.

External launch remains HELD.

---

Generated by Claude Code