ragleap-memory v0.2.0 release notes

Behaviour changes (read first)

search now writes: it records the tokens it served. A store opened read-only will fail on search.
A 0.1.0 database file is migrated in place on first open (one transaction). 0.1.0 cannot open a migrated file, so back the file up first if you may need to go back.
SQLite 3.24 or newer is required (upserts), as well as FTS5.
MemoryEntry and SearchHit have a new tokens field, and export dictionaries have a new "tokens" key.

search(..., max_tokens=N): a hard budget on the estimated tokens returned; an entry that does not fit is skipped. estimate_tokens (one token per 3 UTF-8 bytes, an estimate, not a real tokenizer) and a token_estimator= option.
usage(scope, period) and per-tenant quota_entries and quota_tokens (off by default) with QuotaExceededError.
ShardedStore: one SQLite file per tenant (hashed file names, directory 0700, files 0600), least-recently-used shards closed beyond max_open, and a tenant-wide erase that deletes the files.
export_file, import_file and import_stream: download and upload of a memory as a JSON Lines file. Import is strict and all-or-nothing: entries are checked like add, trust is capped by max_trust (default untrusted), entries must lie inside the import scope (rescope=True moves a file into your tenant), ids are new and links are remapped, duplicates are skipped, and there are limits on entries, bytes and line length. An export file is plain text (mode 0600).
Threat model rows 10 (bill spike), 11 (shared index) and 12 (hostile upload file); the mutation check now has 84 mutations.

306 tests pass and all 84 mutations are killed, both in the author's sandbox (Python 3.12, SQLite 3.45.1) and on the VPS (Python 3.10.12, SQLite 3.37.2).
CI on #1107 (code) and #1156 (release): 49 checks passed on each, including ragleap-memory-tests on Python 3.10, 3.11 and 3.12 and the Plugin Security Scan.
pip install ragleap-memory==0.2.0 from PyPI into a clean Python 3.10 venv (with ragleap-security 0.1.0), then the README example ran: budgeted search, usage, export, import and ShardedStore.
The published wheel and sdist have the same sha256 as the local build made before the tag. The wheel also matches a separate build made on Python 3.12.
One benchmark run on the VPS (synthetic text, details in the CHANGELOG): a 300-token budget held in every case while unbudgeted searches served 859 to 1,057 tokens on average; with 100 tenants and 100,000 entries a query on one tenant had a median of 5.4 ms with ShardedStore against 28.9 ms with one shared file. Numbers varied between runs, so treat them as orders of magnitude.

Speed beyond that single run: 1,000,000 entries, other hardware or disks, real text, several processes, and the speed of import_file.
Windows, network file systems, several processes writing one file, power-loss durability, and more than a few threads on ShardedStore.
Retrieval quality and multilingual precision (unchanged from 0.1.0); token estimates against any real tokenizer.
TestPyPI: not published for 0.2.0. The PyPI provenance display for this release was not checked by us.
No independent security review has been done. Alpha software.

Tag ragleap-memory-v0.2.0 (annotated) on merge commit 5fb1736163db9066578e97f8b8962900fbc2a460.
Pull requests: #1107 (code), #1156 (release changelog). Release run: 41450261330.
Uploaded to PyPI on 2026-11-02T13:08:00.892378Z (wheel) and 2026-11-02T13:08:02.086237Z (sdist).
Wheel ragleap_memory-0.2.0-py3-none-any.whl sha256 96e268599dbaf52a4362191dab22b113656b792b170d437bf5f18ba8ba276ce5
Sdist ragleap_memory-0.2.0.tar.gz sha256 92ce57df7244284eade673c8cbc4de121e5e3765046487fbf92f16e27c9c37a2
Digests were read from PyPI's JSON by script, not retyped.