v0.2.0 -- Memory that resists being quietly rewritten

Memory that resists being quietly rewritten. This release came out of testing Palimpsest as a gate in front of a RAG pipeline in Aegis Vector, an adversarial testbed that plants forged policy documents and measures whether local models believe them. Two of Palimpsest's own rules turned out to be exploitable; both are closed here without giving up the rules themselves.

What changed:

• Value-aware collisions (consult.py). Token overlap measures shared vocabulary, not agreement: a forged policy that copied the real one's wording and changed only the figure scored 0.83 overlap and was filed as reinforcing the real claim, raising its weight. Now, when each claim states a quantity the other doesn't ($10,000 vs $5,000,000), high overlap never counts as confirmation. In an ATTRIBUTE domain that's a collision (open, dated, figures named in tolerance_context); in an EVENT domain it's a different event (COEXISTS, weight untouched). One side adding a figure is elaboration and still reinforces; $10K and 10,000 normalize to the same value.
• Exceptions that change a number are marked for review (models.py, consult.py). The dog/Rex rule holds: a general claim and a specific instance never collide. But that let "for the Q3 IT refresh only, department heads may approve up to $5,000,000" pass as an ordinary exception. It's still a SCOPE_LINK, but the edge now carries the new EdgeStatus.REVIEW_NEEDED with both figures recorded. Weights are untouched and nothing is decided. Scope edges without competing figures keep no status.
• pending_reviews() lists everything waiting on a person, open collisions and marked exceptions, oldest first. Nothing in it resolves itself.
• Weight decay (decay.py). Exponential decay toward a floor for ATTRIBUTE-domain episodes that stop being reinforced; composable over repeated calls, and fresh reinforcement resets the clock.
• Fixes: quantities glued to a letter (Q3) are labels, not values; pip install -e . works (explicit package discovery).

Measured, not claimed: in Aegis Vector's defenses battery (five small local models, six forged payloads), Palimpsest as an ingestion gate quarantined every forgery, including one written as a one-off exception, where no other single defense tested got to zero adoption without refusing answers. The scenario is narrow (forged figures for registered facts), and the README says what's untested.

72 tests, all passing. store.py's Elasticsearch backend is still unverified against a live cluster, and collision resolution is still scripted.