(Depends on #1597) Evict near-duplicate derivatives at ingest (speedkick) - #1617

Implements the session/source/expansion/eviction part of
design/event_memory_handoff.md from the tenant-lifecycle branch. The
context-part and block-kind model and the segmenter/deriver tables
follow in a second change; this one keeps the producer/null context
union and the `block_type` discriminator as they are.

Data models. `Event`, `Segment` and `Derivative` carry `session_id`
and `source_id` as nullable fields, copied verbatim down the
pipeline; null is encoded as a missing record key, `None` in a typed
id list selects it, and property values stay `None`-free. `SearchHit(score, seed, segments)` replaces
`ScoredSegmentContext` and `QueryResult`; `Neighborhood(before,
after)` and `EvictionOptions` are added.

Reserved keys. `common/property_keys.py` reserves the `memmachine_`
namespace; every system value a search filters on at the vector stage
sits in the record under a reserved key (`event_timestamp`,
`event_session`, `event_source`, `block_kind`). `utils.py` owns the
translation between the typed filters (`since`, `until`, `session_ids`,
`source_ids`, `block_kinds`) and filter trees; a caller key in the
namespace is rejected before any segment is written.

Segment store. `segment_store_sg` gains `session_id`, `source_id` and
`block_kind` columns, a session-led ordering index and a source index; the total order is
`(timestamp, event_uuid, index, offset)`, windows and neighborhoods
are confined to the seed's session, and a null session is one stream.
`get_segment_windows` takes `before`/`after` and the typed filters;
`get_segment_neighborhoods` returns the neighbors and never the seed, as two
lists; `delete_derivatives` unlinks without touching segments; PG
lateral reads run one statement pair per seed session. No migration:
`startup()` keeps `create_all`, and an existing speedkick database is
recreated; schema migration waits for the lifecycle/DDL changes.

EventMemory. `encode_events` forgets the batch first, so a repeat
leaves one copy, and runs eviction from the agentic_expansion branch,
cosine only: batch predecessors, one bounded neighbor query per
derivative, a cluster over `target_size` trimmed from its temporal
middle, displaced records and their links deleted, skipped ones never
written. `query` is the vector stage and returns hits with the seed's
index in its window; `rerank` is the second stage, static, for a
caller with a reranker; `expand` walks a neighborhoods from a segment
or event anchor; `render` replaces the string formatters. The reranker
and the per-call format options leave the constructor and the call,
respectively; the deriver's format is fixed per memory.

Server. `LongTermMemory` sets `Event.source_id` from the producer id,
leaves the session null and keeps the producer context; it reranks after `query` and reads
hits.

Tests: the branch's neighbor and eviction tests ported to the new
shapes on both dialects, plus session confinement, half-open bounds,
instant comparison of zoned bounds on SQLite, source and kind filters,
and link deletion. Each new store assertion was checked to fail
against a mutated store (no session predicate, an inclusive `until`, a
filtered neighborhoods seed, an unnormalized bound).

Rebased 2026-09-10 onto speedkick after MemMachine#1598 merged, adopting its
post-review names (`segment_by_derivative`, `seed_cosine_similarities`).
`common/property_keys.py` and its test, which MemMachine#1598 did not carry into
its merge, are included here.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MuAu353FiSmCJjLX1LWDQW
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

Two `if`s say what a loop over a tuple of names said; `_in_values` is a
static method under `_row_conditions`, the one place that calls it; and
the comment on an empty lookup says what the registry read is for.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

The order that put the incarnation second removed a competitor from the
planner's candidates for the link table's foreign-key check; it did not
make the planner choose well, statistics do. A fresh PostgreSQL table
misplans until its first ANALYZE whatever the indexes (the lookup by
uuid runs a sequential scan in that window too), and autovacuum's first
pass, or an ANALYZE after an initial import, ends it for the table's
lifetime. So the indexes read as the rest of the store does, scoped by
the incarnation first, and the PR body states the practice.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

The source-pinned walk index served a walk filtered by one source, and
no measured workload runs one; the session-led index serves every walk,
and a filter on source or kind scans past the session's other rows, tens
of microseconds on a 200,000-row table. An index is paid for on every
insert for as long as it exists, and adding one later is a one-off
background build (2.5 s per million rows on PostgreSQL, concurrently),
so the store indexes the reads it has: the primary key, lookup by
event, and the walk. A walk filtered by source or by kind earns its
index when a workload shows it.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE

`encode_events` no longer forgets the batch's events before encoding
them: every call adds, and encoding an event a second time stores a
second copy, as speedkick's encode does. The forget-first step widened a
race that speedkick already has: a forget that runs between an encode's
segment commit and its vector upsert orphans the encode's records, and
with encode forgetting first, a concurrent re-encode of one event took
that path too. A follow-up moves the upsert inside the write transaction
and rejects a reused event uuid at the store; until then encode is a
plain insert.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YBbQgZiCqeoLu83EkbEFHE