@merittdev/horus 0.12.2 → 0.12.4

package/dist/index.cjs

@@ -65880,8 +65880,8 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.12.2" : "dev";
-var PINNED_SOURCE_VERSION = "2.0.1";
+var HORUS_VERSION = true ? "0.12.4" : "dev";
+var PINNED_SOURCE_VERSION = "2.0.2";
 
 // ../../packages/core/src/evidence.ts
 init_cjs_shims();
@@ -71127,6 +71127,42 @@ async function assertSourceVersionPinned() {
 function isAnalyzed(root) {
   return (0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, ".horus", "source"));
 }
+var CURRENT_STORE_BACKEND = (process.env["HORUS_SOURCE_STORAGE_BACKEND"] ?? "sqlite").trim().toLowerCase();
+function readSourceMeta(root) {
+  try {
+    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(root, ".horus", "source", "meta.json"), "utf8");
+    const j3 = JSON.parse(raw);
+    const stats = j3["stats"] ?? void 0;
+    return {
+      storeBackend: typeof j3["store_backend"] === "string" ? j3["store_backend"].toLowerCase() : void 0,
+      embeddingsComplete: typeof j3["embeddings_complete"] === "boolean" ? j3["embeddings_complete"] : void 0,
+      stats: stats ? { symbols: stats["symbols"], embeddings: stats["embeddings"] } : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function metaHasEmbeddings(meta) {
+  if (meta.embeddingsComplete === false) return false;
+  const embeddings = meta.stats?.embeddings ?? 0;
+  const symbols = meta.stats?.symbols ?? 0;
+  return !(symbols > 0 && embeddings === 0);
+}
+function indexNeedsReanalyze(root) {
+  if (!isAnalyzed(root)) return null;
+  if (CURRENT_STORE_BACKEND !== "kuzu" && (0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, ".horus", "source", "kuzu"))) {
+    return "legacy K\xF9zuDB store present";
+  }
+  const meta = readSourceMeta(root);
+  if (meta === null) return null;
+  if (meta.storeBackend && meta.storeBackend !== CURRENT_STORE_BACKEND) {
+    return `store backend changed (${meta.storeBackend} -> ${CURRENT_STORE_BACKEND})`;
+  }
+  if (!metaHasEmbeddings(meta)) {
+    return "index has no semantic embeddings (symbols present but 0 vectors)";
+  }
+  return null;
+}
 async function analyzeRepo(root) {
   const bin = await resolveSourceBin();
   if (!bin) throw new Error("horus-source not found on PATH. Install it: curl -fsSL https://horus.sh/install.sh | bash");
@@ -71457,7 +71493,7 @@ var SourceCodeProvider = class {
     if (n4.className) symbol.className = n4.className;
     if (n4.language) symbol.language = n4.language;
     const content = n4.content;
-    const snippet = typeof content === "string" ? content.slice(0, 600) : void 0;
+    const snippet2 = typeof content === "string" ? content.slice(0, 600) : void 0;
     const sourceBody = typeof content === "string" ? content.slice(0, 2e4) : void 0;
     const callees = (detail.callees ?? []).map((c4) => this.serializedToSymbol(c4.node));
     const callers = (detail.callers ?? []).map((c4) => this.serializedToSymbol(c4.node));
@@ -71471,7 +71507,7 @@ var SourceCodeProvider = class {
     }));
     return {
       symbol,
-      snippet,
+      snippet: snippet2,
       ...sourceBody !== void 0 ? { sourceBody } : {},
       callers,
       callees,
@@ -71586,6 +71622,167 @@ var SourceMemoryVectorIndex = class {
 // ../../packages/connectors/src/contract.ts
 init_cjs_shims();
 
+// ../../packages/connectors/src/duration.ts
+init_cjs_shims();
+function readPath(obj, path) {
+  if (Object.prototype.hasOwnProperty.call(obj, path)) return obj[path];
+  const parts2 = path.split(".");
+  let node = obj;
+  for (const part of parts2) {
+    if (node === null || typeof node !== "object") return void 0;
+    node = node[part];
+  }
+  return node;
+}
+var UNIT_MS = {
+  h: 36e5,
+  m: 6e4,
+  s: 1e3,
+  ms: 1,
+  us: 1e-3,
+  "\xB5s": 1e-3,
+  ns: 1e-6
+};
+var DURATION_TOKEN = /(\d+(?:\.\d+)?)\s*(ms|us|µs|ns|h|m|s)(?![a-zA-Z])/gi;
+function parseDurationMs(raw) {
+  if (typeof raw !== "string") return null;
+  const s5 = raw.trim().replace(/^~/, "");
+  if (s5 === "") return null;
+  let total = 0;
+  let matched = false;
+  DURATION_TOKEN.lastIndex = 0;
+  let m5;
+  while ((m5 = DURATION_TOKEN.exec(s5)) !== null) {
+    const value = Number(m5[1]);
+    const unit = m5[2].toLowerCase();
+    const factor = UNIT_MS[unit];
+    if (Number.isFinite(value) && factor !== void 0) {
+      total += value * factor;
+      matched = true;
+    }
+  }
+  if (matched) return total;
+  if (/^\d+(?:\.\d+)?$/.test(s5)) {
+    const n4 = Number(s5);
+    return Number.isFinite(n4) ? n4 : null;
+  }
+  return null;
+}
+function extractByRegex(text2, regex) {
+  const m5 = regex.exec(text2);
+  if (m5 === null) return null;
+  const captured = m5[1] ?? m5[0];
+  const v4 = captured.trim();
+  return v4 === "" ? null : v4;
+}
+function percentile(sortedAsc, p5) {
+  const n4 = sortedAsc.length;
+  if (n4 === 0) return 0;
+  if (n4 === 1) return sortedAsc[0];
+  const rank = Math.ceil(p5 / 100 * n4);
+  const idx = Math.min(n4 - 1, Math.max(0, rank - 1));
+  return sortedAsc[idx];
+}
+function computeStat(durations) {
+  const finite = durations.filter((d3) => Number.isFinite(d3));
+  if (finite.length === 0) {
+    return { avg: 0, p95: 0, count: 0, min: 0, max: 0 };
+  }
+  const sorted = [...finite].sort((a2, b5) => a2 - b5);
+  const sum = sorted.reduce((acc, d3) => acc + d3, 0);
+  return {
+    avg: sum / sorted.length,
+    p95: percentile(sorted, 95),
+    count: sorted.length,
+    min: sorted[0],
+    max: sorted[sorted.length - 1]
+  };
+}
+function readDimension(rec, spec) {
+  if (spec.field !== void 0) {
+    const raw = readPath(rec.fields, spec.field);
+    if (raw === null || raw === void 0) {
+      if (spec.pattern === void 0) return null;
+    } else {
+      const v4 = String(raw).trim();
+      if (v4 !== "") return v4;
+      if (spec.pattern === void 0) return null;
+    }
+  }
+  if (spec.pattern !== void 0) {
+    const sourceField = spec.patternField;
+    const text2 = sourceField !== void 0 ? typeof readPath(rec.fields, sourceField) === "string" ? readPath(rec.fields, sourceField) : String(readPath(rec.fields, sourceField) ?? "") : rec.message ?? "";
+    if (text2 === "") return null;
+    try {
+      return extractByRegex(text2, new RegExp(spec.pattern));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readDuration(rec, opts) {
+  if (opts.durationField !== void 0) {
+    const raw = readPath(rec.fields, opts.durationField);
+    if (typeof raw === "number" && Number.isFinite(raw)) {
+      return opts.durationFieldUnit === "s" ? raw * 1e3 : raw;
+    }
+    if (typeof raw === "string") return parseDurationMs(raw);
+    return null;
+  }
+  const msg = rec.message ?? "";
+  if (msg === "") return null;
+  if (opts.durationPattern !== void 0) {
+    let isolated;
+    try {
+      isolated = extractByRegex(msg, new RegExp(opts.durationPattern));
+    } catch {
+      isolated = null;
+    }
+    return isolated !== null ? parseDurationMs(isolated) : null;
+  }
+  return parseDurationMs(msg);
+}
+function extractDurationSamples(records, opts) {
+  const needle = opts.completionText?.toLowerCase();
+  const out2 = [];
+  for (const rec of records) {
+    if (needle !== void 0) {
+      const hay = (rec.message ?? "").toLowerCase();
+      if (!hay.includes(needle)) continue;
+    }
+    const dimension = readDimension(rec, opts.dimension);
+    if (dimension === null) continue;
+    const durationMs = readDuration(rec, opts);
+    if (durationMs === null || !Number.isFinite(durationMs)) continue;
+    out2.push({ dimension, durationMs });
+  }
+  return out2;
+}
+function aggregateDurations(samples, dimensionName) {
+  if (samples.length === 0) return null;
+  const grouped = /* @__PURE__ */ new Map();
+  for (const s5 of samples) {
+    const list = grouped.get(s5.dimension);
+    if (list === void 0) grouped.set(s5.dimension, [s5.durationMs]);
+    else list.push(s5.durationMs);
+  }
+  const byValue = {};
+  for (const [value, durations] of grouped) {
+    byValue[value] = computeStat(durations);
+  }
+  return {
+    dimension: dimensionName,
+    unit: "ms",
+    byValue,
+    sampleCount: samples.length
+  };
+}
+function durationsByDimension(records, opts) {
+  const samples = extractDurationSamples(records, opts);
+  return aggregateDurations(samples, opts.dimension.name);
+}
+
 // ../../packages/connectors/src/factory.ts
 init_cjs_shims();
 
@@ -72486,6 +72683,33 @@ var ElasticsearchLogsProvider = class {
     }
     return analysis;
   }
+  async analyzeDurations(opts) {
+    try {
+      const q2 = {
+        level: opts.level ?? "info",
+        limit: opts.limit ?? 500,
+        ...opts.service !== void 0 ? { service: opts.service } : {},
+        ...opts.from !== void 0 ? { from: opts.from } : {},
+        ...opts.to !== void 0 ? { to: opts.to } : {},
+        ...opts.completionText !== void 0 ? { text: opts.completionText, broadText: true } : {}
+      };
+      const records = await this.searchLogs(q2);
+      const normalized = records.map((r) => ({
+        message: r.message,
+        fields: {
+          ...r.raw,
+          ...r.context !== void 0 ? { context: r.context } : {},
+          ...r.eventCode !== void 0 ? { event_code: r.eventCode } : {},
+          ...r.service !== void 0 ? { service_name: r.service } : {},
+          ...r.detail !== void 0 ? { detail: r.detail } : {},
+          message: r.message
+        }
+      }));
+      return durationsByDimension(normalized, opts);
+    } catch {
+      return null;
+    }
+  }
   async checkCompatibility(opts) {
     const fields = [
       this.mapping.timestampField,
@@ -72706,6 +72930,85 @@ function compareWindows(baseline, current, spikeRatio = 1.5) {
   comparisons.sort((a2, b5) => b5.delta - a2.delta);
   return comparisons;
 }
+function quantileSorted(sortedAsc, p5) {
+  const n4 = sortedAsc.length;
+  if (n4 === 0) return NaN;
+  if (n4 === 1) return sortedAsc[0];
+  const pos = (n4 - 1) * p5;
+  const lo = Math.floor(pos);
+  const hi = Math.ceil(pos);
+  if (lo === hi) return sortedAsc[lo];
+  const frac = pos - lo;
+  return sortedAsc[lo] * (1 - frac) + sortedAsc[hi] * frac;
+}
+function median(values2) {
+  const finite = values2.filter((v4) => Number.isFinite(v4));
+  if (finite.length === 0) return NaN;
+  const sorted = [...finite].sort((a2, b5) => a2 - b5);
+  return quantileSorted(sorted, 0.5);
+}
+function detectBimodalPopulation(comparisons, opts) {
+  const spike = opts?.spike ?? 1.5;
+  const drop = opts?.drop ?? 0.67;
+  const minShare = opts?.minShare ?? 0.2;
+  const minMinority = opts?.minMinority ?? 2;
+  const minTotal = opts?.minTotal ?? 3;
+  const gapFactor = opts?.gapFactor ?? 2;
+  const total = comparisons.length;
+  const empty = {
+    bimodal: false,
+    total,
+    highCount: 0,
+    lowCount: 0,
+    degenerateCount: 0,
+    highShare: 0,
+    lowShare: 0,
+    highRatio: NaN,
+    lowRatio: NaN
+  };
+  const highRatios = [];
+  const lowRatios = [];
+  let degenerateCount = 0;
+  for (const c4 of comparisons) {
+    const r = c4.ratio;
+    if (!Number.isFinite(r)) {
+      degenerateCount += 1;
+    } else if (r >= spike) {
+      highRatios.push(r);
+    } else if (r > 0 && r <= drop) {
+      lowRatios.push(r);
+    } else if (r === 0) {
+      degenerateCount += 1;
+    }
+  }
+  const highCount = highRatios.length;
+  const lowCount = lowRatios.length;
+  const counterCount = lowCount + degenerateCount;
+  const result = {
+    ...empty,
+    highCount,
+    lowCount,
+    degenerateCount,
+    highShare: total > 0 ? highCount / total : 0,
+    lowShare: total > 0 ? counterCount / total : 0,
+    highRatio: median(highRatios),
+    lowRatio: median(lowRatios)
+  };
+  if (total < minTotal) return result;
+  if (highCount < 1 || counterCount < 1) return result;
+  if (counterCount < minMinority) return result;
+  if (result.lowShare < minShare) return result;
+  if (highCount < minMinority && result.highShare < minShare) return result;
+  if (lowCount > 0) {
+    const hi = result.highRatio;
+    const lo = result.lowRatio;
+    if (Number.isFinite(hi) && Number.isFinite(lo) && lo > 0 && hi / lo < gapFactor) {
+      return result;
+    }
+  }
+  result.bimodal = true;
+  return result;
+}
 
 // ../../packages/connectors/src/grafana/panels.ts
 init_cjs_shims();
@@ -72833,8 +73136,19 @@ function classifyAnomaly(kind, cmp, opts) {
 }
 function buildFindings(dashboardUid, panelTitle, kind, baseline, current) {
   const comparisons = compareWindows(baseline, current);
+  const bimodal = detectBimodalPopulation(comparisons);
+  const spike = 1.5;
+  const drop = 0.67;
+  const isBimodalMember = (cmp) => {
+    const r = cmp.ratio;
+    if (!Number.isFinite(r)) return true;
+    if (r >= spike) return true;
+    if (r === 0) return true;
+    return r > 0 && r <= drop;
+  };
   return comparisons.map((cmp) => {
-    const anomaly = classifyAnomaly(kind, cmp);
+    const baseAnomaly = classifyAnomaly(kind, cmp);
+    const anomaly = bimodal.bimodal && baseAnomaly !== "none" && isBimodalMember(cmp) ? "bimodal-population" : baseAnomaly;
     const currentSeries = current.find((s5) => {
       const keys = Object.keys(cmp.labels);
       return keys.every((k3) => s5.labels[k3] === cmp.labels[k3]);
@@ -72865,6 +73179,8 @@ function anomalyLabel(anomaly) {
       return "Queue Growth";
     case "change":
       return "Change";
+    case "bimodal-population":
+      return "Bimodal Population (possible per-segment variance)";
     case "none":
       return "No Anomaly";
   }
@@ -72879,6 +73195,11 @@ function anomalyRelevance(anomaly) {
       return 0.8;
     case "change":
       return 0.55;
+    // Lower than a confident single-cause spike: a two-population pattern is a
+    // hypothesis ("per-segment variance"), not a uniform regression — keep the
+    // engine honest by NOT presenting it with spike-level weight (HOR-435).
+    case "bimodal-population":
+      return 0.6;
     case "none":
       return 0;
   }
@@ -74009,6 +74330,37 @@ var AxiomProvider = class {
       return [];
     }
   }
+  /**
+   * INFO-level duration coverage (HOR-434). Query NON-error completion/duration rows
+   * (e.g. `Completed MANAGE_SALES:KSA ~2m10s`) and aggregate duration by an extracted
+   * dimension (region / market / tenant) — from a structured field or a regex over the
+   * job id / message. Returns per-dimension stats `{ region: { KSA: {avg,p95,count,…} } }`
+   * so the engine sees per-segment variance the error-biased `collect()` path misses.
+   *
+   * Graceful: no completion rows, no parseable duration, or no extractable dimension
+   * → `null`. Never throws.
+   */
+  async analyzeDurations(opts) {
+    try {
+      const to = opts.to ?? (/* @__PURE__ */ new Date()).toISOString();
+      const from = opts.from ?? new Date(
+        Date.parse(to) - (this.opts.windowMs ?? DEFAULT_WINDOW_MS)
+      ).toISOString();
+      const apl = buildApl(
+        this.opts.dataset,
+        opts.completionText !== void 0 ? [opts.completionText] : [],
+        opts.limit ?? 500
+      );
+      const rows = await this.client.query(apl, from, to);
+      const normalized = rows.map((rec) => ({
+        message: pickField2(rec.fields, MESSAGE_FIELDS) ?? "",
+        fields: rec.fields
+      }));
+      return durationsByDimension(normalized, opts);
+    } catch {
+      return null;
+    }
+  }
   async health() {
     return this.client.health();
   }
@@ -92770,6 +93122,36 @@ function generateHypotheses(evidence2, _correlation, ctx) {
     contradictingEvidenceIds: [],
     missingEvidence: infraSupport.length > 0 ? [] : ["Infrastructure metrics + datastore/cache state (`horus metrics`)"]
   });
+  const benignSupport = [
+    .../* @__PURE__ */ new Set([
+      ...ctx.perDimensionDurationEvIds ?? [],
+      ...ctx.bimodalMetricEvIds ?? []
+    ])
+  ];
+  if (benignSupport.length > 0 || ctx.benignVarianceApplicable === true) {
+    hyps.push({
+      id: globalThis.crypto.randomUUID(),
+      category: "benign-variance",
+      statement: "The anomaly may reflect expected per-segment/per-region variance (or a skewed average), not a failure.",
+      confidence: 0.1,
+      supportingEvidenceIds: benignSupport,
+      contradictingEvidenceIds: [],
+      missingEvidence: benignSupport.length > 0 ? [] : [
+        "Per-segment duration breakdown (region/market/tenant) or a bimodal metric distribution (`horus logs` / `horus metrics`)"
+      ]
+    });
+  }
+  const suggested = new Set(ctx.alertSuggestedCategories ?? []);
+  if (suggested.size > 0) {
+    for (const h3 of hyps) {
+      if (suggested.has(h3.category) && h3.supportingEvidenceIds.length === 0) {
+        h3.missingEvidence = [
+          ...h3.missingEvidence,
+          "Suggested by the alert/hint text \u2014 confidence requires independent evidence, not the alert wording itself"
+        ];
+      }
+    }
+  }
   hyps.sort((a2, b5) => b5.confidence - a2.confidence);
   return hyps;
 }
@@ -92817,6 +93199,26 @@ function validateHypotheses(hyps, evidence2) {
       rationale
     };
   });
+  const SHARED_EVIDENCE_CEILING = 0.75;
+  const bySupport = /* @__PURE__ */ new Map();
+  for (const v4 of validated) {
+    if (v4.contradictingPresent > 0) continue;
+    const presentSupport = v4.supportingEvidenceIds.filter((id) => present.has(id)).sort();
+    if (presentSupport.length === 0) continue;
+    const key = presentSupport.join("|");
+    const list = bySupport.get(key);
+    if (list === void 0) bySupport.set(key, [v4]);
+    else list.push(v4);
+  }
+  for (const cohort of bySupport.values()) {
+    if (cohort.length < 2) continue;
+    for (const v4 of cohort) {
+      if (v4.confidence > SHARED_EVIDENCE_CEILING) {
+        v4.confidence = SHARED_EVIDENCE_CEILING;
+        v4.rationale = v4.rationale.replace(/\.$/, "") + `; capped at ${SHARED_EVIDENCE_CEILING} \u2014 shares all supporting evidence with ${cohort.length - 1} other hypothesis(es) and nothing distinguishes them.`;
+      }
+    }
+  }
   validated.sort((a2, b5) => {
     const aElim = a2.verdict === "eliminated" ? 1 : 0;
     const bElim = b5.verdict === "eliminated" ? 1 : 0;
@@ -93004,7 +93406,13 @@ var MEMORY_RELS = /* @__PURE__ */ new Set([
 function isSymmetricRel(rel) {
   return rel === "recurs-with";
 }
-var INCIDENT_DERIVED_KINDS = /* @__PURE__ */ new Set(["confirmed-outcome", "incident-pattern"]);
+var INCIDENT_DERIVED_KINDS = /* @__PURE__ */ new Set([
+  "confirmed-outcome",
+  "incident-pattern",
+  // HOR-432: auto-captured investigation memories carry the same incident-family signature/tags so
+  // they participate in recurrence detection. CONTEXT-ONLY — never read by the scoring path.
+  "investigation"
+]);
 function normalizeStoredSignature(sig) {
   const s5 = (sig ?? "").trim();
   if (s5 === "" || /^\|*$/.test(s5)) return null;
@@ -93109,6 +93517,35 @@ function createLocalMemoryStore(db) {
       });
       return row;
     },
+    async update(id, patch, opts) {
+      const current = await getById(id);
+      if (current === null) throw new Error(`memory item not found: ${id}`);
+      const set = {};
+      if (patch.claim !== void 0) {
+        assertClaimClean(patch.claim);
+        set.claim = patch.claim;
+      }
+      if (patch.confidence !== void 0) set.confidence = patch.confidence;
+      if (patch.payload !== void 0) set.payload = patch.payload;
+      if (Object.keys(set).length > 0) {
+        await db.update(memoryItem).set(set).where(eq(memoryItem.id, id));
+      }
+      await appendAudit({
+        memoryId: id,
+        action: opts.action ?? "update",
+        actor: opts.audit.actor,
+        fromStatus: null,
+        toStatus: null,
+        note: opts.audit.note ?? null,
+        detail: {
+          ...opts.detection ? { detection: opts.detection } : {},
+          ...opts.detail ?? {}
+        }
+      });
+      const updated = await getById(id);
+      if (updated === null) throw new Error(`memory item vanished during update: ${id}`);
+      return updated;
+    },
     get: getById,
     async query(q2) {
       const repo = q2.repo.trim();
@@ -93296,6 +93733,395 @@ function createLocalMemoryStore(db) {
   };
 }
 
+// ../../packages/engine/src/auto-investigation-memory.ts
+init_cjs_shims();
+
+// ../../packages/engine/src/memory-detect.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+
+// ../../packages/engine/src/memory-store.ts
+init_cjs_shims();
+var HIDDEN_STATUSES = [
+  "forgotten",
+  "deprecated",
+  "contradicted"
+];
+function tokenize2(text2) {
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const raw of text2.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw !== "" && !seen.has(raw)) {
+      seen.add(raw);
+      out2.push(raw);
+    }
+  }
+  return out2;
+}
+function scopeSpecificity(scope) {
+  if (scope.startsWith("symbol:")) return 3;
+  if (scope.startsWith("module:")) return 2;
+  if (scope === "repo") return 1;
+  return 0;
+}
+var NoopVectorIndex = class {
+  entries = /* @__PURE__ */ new Map();
+  async upsert(i3) {
+    this.entries.set(i3.memoryId, {
+      memoryId: i3.memoryId,
+      repo: i3.repo,
+      scope: i3.scope,
+      tokens: tokenize2(i3.claim)
+    });
+  }
+  async search(i3) {
+    const repo = i3.repo.trim();
+    if (repo === "") return [];
+    const queryTokens = tokenize2(i3.query);
+    if (queryTokens.length === 0) return [];
+    const scored = [...this.entries.values()].filter((e) => e.repo === repo).map((e) => ({
+      memoryId: e.memoryId,
+      score: tagOverlap(queryTokens, e.tokens),
+      specificity: scopeSpecificity(e.scope)
+    })).filter((h3) => h3.score > 0).sort(
+      (a2, b5) => b5.score - a2.score || b5.specificity - a2.specificity || (a2.memoryId < b5.memoryId ? -1 : a2.memoryId > b5.memoryId ? 1 : 0)
+    );
+    const limit = Number.isFinite(i3.limit) && i3.limit > 0 ? Math.floor(i3.limit) : scored.length;
+    return scored.slice(0, limit).map((h3) => ({ memoryId: h3.memoryId, score: h3.score }));
+  }
+  async remove(memoryId) {
+    this.entries.delete(memoryId);
+  }
+};
+
+// ../../packages/engine/src/memory-detect.ts
+var TAG_OVERLAP_MIN = 0.6;
+var CLAIM_JACCARD_MIN = 0.6;
+var MIN_CLAIM_TOKENS = 4;
+var INCIDENT_DERIVED_KINDS2 = /* @__PURE__ */ new Set([
+  "confirmed-outcome",
+  "incident-pattern"
+]);
+function usableSignature(sig) {
+  const s5 = (sig ?? "").trim();
+  if (s5 === "" || /^\|*$/.test(s5)) return null;
+  const components = s5.split(/[|,]/).map((c4) => c4.trim()).filter((c4) => c4 !== "");
+  if (components.length === 0) return null;
+  if (components.every((c4) => isGenericTag(c4))) return null;
+  return s5;
+}
+function sharedNonGenericTags(a2, b5) {
+  const setB = new Set(b5);
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const t2 of a2) {
+    if (setB.has(t2) && !isGenericTag(t2) && !seen.has(t2)) {
+      seen.add(t2);
+      out2.push(t2);
+    }
+  }
+  return out2;
+}
+function recurrenceEdgeId(idA, idB) {
+  const [lo, hi] = idA <= idB ? [idA, idB] : [idB, idA];
+  const h3 = (0, import_node_crypto3.createHash)("sha256").update(`recurs-with\0${lo}\0${hi}`).digest("hex");
+  return `lnk_recurs_${h3.slice(0, 32)}`;
+}
+function normalizeCause(s5) {
+  return (s5 ?? "").trim().toLowerCase().replace(/\s+/g, " ");
+}
+function outcomeConflict(a2, b5) {
+  const opposite = a2.resolved === "yes" && b5.resolved === "no" || a2.resolved === "no" && b5.resolved === "yes";
+  if (opposite) {
+    return `outcome verdicts disagree (${a2.resolved} vs ${b5.resolved})`;
+  }
+  const ca = normalizeCause(a2.confirmedCause);
+  const cb = normalizeCause(b5.confirmedCause);
+  if (ca !== "" && cb !== "" && ca !== cb) {
+    return `confirmed causes differ ("${a2.confirmedCause}" vs "${b5.confirmedCause}")`;
+  }
+  return null;
+}
+function recurrenceReason(a2, b5) {
+  const sigA = usableSignature(a2.signature);
+  const sigB = usableSignature(b5.signature);
+  if (sigA !== null && sigB !== null && sigA === sigB) {
+    return `identical incident signature "${sigA}"`;
+  }
+  const tagsA = a2.tags ?? [];
+  const tagsB = b5.tags ?? [];
+  const shared = sharedNonGenericTags(tagsA, tagsB);
+  const overlap = tagOverlap([...tagsA], [...tagsB]);
+  if (overlap >= TAG_OVERLAP_MIN && shared.length >= 1) {
+    return `tag overlap ${overlap.toFixed(2)} on [${shared.join(", ")}]`;
+  }
+  if (sigA === null && sigB === null && shared.length >= 1) {
+    const ta = tokenize2(a2.claim);
+    const tb = tokenize2(b5.claim);
+    if (ta.length >= MIN_CLAIM_TOKENS && tb.length >= MIN_CLAIM_TOKENS) {
+      const j3 = tagOverlap(ta, tb);
+      if (j3 >= CLAIM_JACCARD_MIN) {
+        return `claim similarity ${j3.toFixed(2)} corroborated by [${shared.join(", ")}]`;
+      }
+    }
+  }
+  return null;
+}
+function edgeKey(rel, from, to) {
+  if (rel === "recurs-with" || rel === "contradicts") {
+    const [lo, hi] = from <= to ? [from, to] : [to, from];
+    return `${rel}|${lo}|${hi}`;
+  }
+  return `${rel}|${from}|${to}`;
+}
+async function detectMemoryEdges(store, opts, deps = {}) {
+  const repo = opts.repo.trim();
+  if (repo === "") return [];
+  const items = await store.query({ repo, limit: opts.limit ?? 1e3 });
+  const candidates = items.filter((i3) => INCIDENT_DERIVED_KINDS2.has(i3.kind));
+  if (candidates.length < 2) return [];
+  const existing = /* @__PURE__ */ new Set();
+  const investigationOf = /* @__PURE__ */ new Map();
+  for (const item of candidates) {
+    const out2 = await store.links(item.id, { direction: "out" });
+    for (const l2 of out2) {
+      if (l2.toKind === "memory") {
+        existing.add(edgeKey(l2.rel, l2.fromMemoryId, l2.toRef));
+      } else if (l2.toKind === "incident" && l2.rel === "about-incident") {
+        if (!investigationOf.has(item.id)) investigationOf.set(item.id, l2.toRef);
+      }
+    }
+  }
+  const proposals = [];
+  const outcomeCache = /* @__PURE__ */ new Map();
+  const resolveOutcome = async (investigationId) => {
+    if (deps.outcomeFor === void 0) return null;
+    if (outcomeCache.has(investigationId)) return outcomeCache.get(investigationId) ?? null;
+    let v4 = null;
+    try {
+      v4 = await deps.outcomeFor(investigationId);
+    } catch {
+      v4 = null;
+    }
+    outcomeCache.set(investigationId, v4);
+    return v4;
+  };
+  for (let i3 = 0; i3 < candidates.length; i3++) {
+    const a2 = candidates[i3];
+    for (let j3 = i3 + 1; j3 < candidates.length; j3++) {
+      const b5 = candidates[j3];
+      if (!existing.has(edgeKey("recurs-with", a2.id, b5.id))) {
+        const reason = recurrenceReason(a2, b5);
+        if (reason !== null) {
+          const [lo, hi] = a2.id <= b5.id ? [a2.id, b5.id] : [b5.id, a2.id];
+          proposals.push({
+            id: recurrenceEdgeId(a2.id, b5.id),
+            fromMemoryId: lo,
+            toMemoryId: hi,
+            rel: "recurs-with",
+            detection: "auto:recurrence",
+            reason
+          });
+        }
+      }
+      if (deps.outcomeFor !== void 0 && a2.kind === "confirmed-outcome" && b5.kind === "confirmed-outcome" && !existing.has(edgeKey("contradicts", a2.id, b5.id))) {
+        const sigA = usableSignature(a2.signature);
+        const sigB = usableSignature(b5.signature);
+        const invA = investigationOf.get(a2.id);
+        const invB = investigationOf.get(b5.id);
+        if (sigA !== null && sigA === sigB && invA !== void 0 && invB !== void 0) {
+          const oa = await resolveOutcome(invA);
+          const ob = await resolveOutcome(invB);
+          if (oa !== null && ob !== null) {
+            const reason = outcomeConflict(oa, ob);
+            if (reason !== null) {
+              const [lo, hi] = a2.id <= b5.id ? [a2.id, b5.id] : [b5.id, a2.id];
+              const invLo = lo === a2.id ? invA : invB;
+              const invHi = lo === a2.id ? invB : invA;
+              proposals.push({
+                id: "",
+                // directional — the store mints the id
+                fromMemoryId: lo,
+                toMemoryId: hi,
+                rel: "contradicts",
+                detection: "auto:contradiction",
+                reason,
+                detail: { investigationIds: [invLo, invHi] }
+              });
+            }
+          }
+        }
+      }
+    }
+  }
+  return proposals;
+}
+
+// ../../packages/engine/src/auto-investigation-memory.ts
+var RECURRENCE_SCAN_LIMIT = 100;
+var MAX_INVESTIGATION_IDS = 20;
+function snippet(text2, max = 140) {
+  const s5 = text2.trim().replace(/\s+/g, " ");
+  return s5.length > max ? `${s5.slice(0, max - 1)}\u2026` : s5;
+}
+function autoInvestigationMemoryEnabled() {
+  const v4 = (process.env.HORUS_AUTO_INVESTIGATION_MEMORY ?? "").trim().toLowerCase();
+  return v4 !== "0" && v4 !== "false" && v4 !== "off" && v4 !== "no";
+}
+function deriveInvestigationFields(report) {
+  const hint = report.input.hint;
+  const topHyp = report.hypotheses[0];
+  const headline = topHyp !== void 0 ? snippet(topHyp.statement || topHyp.category || report.summary) : snippet(report.summary || "(no leading hypothesis)");
+  return {
+    hint,
+    claim: `Investigation: ${snippet(hint)} -> ${headline}`,
+    confidence: report.confidence,
+    signature: deriveSignature(report),
+    tags: deriveTags(report),
+    topHypothesisCategory: topHyp !== void 0 ? topHyp.category ?? null : null
+  };
+}
+function recurrenceCountOf(payload) {
+  if (payload !== null && typeof payload === "object") {
+    const c4 = payload.recurrenceCount;
+    if (typeof c4 === "number" && Number.isFinite(c4) && c4 >= 1) return Math.floor(c4);
+  }
+  return 1;
+}
+async function createInvestigationMemory(store, investigationId, report, audit) {
+  const repo = report.input.repo?.trim() || null;
+  if (repo === null) return null;
+  const fields = deriveInvestigationFields(report);
+  const item = {
+    id: "",
+    kind: "investigation",
+    source: "investigation",
+    scope: "repo",
+    visibility: "private",
+    // HONEST confidence — the report's own value, never inflated.
+    confidence: fields.confidence,
+    claim: fields.claim,
+    repo,
+    evidence: [],
+    // Incident-family recall keys (same derivation as incident_memory) so this memory recurs.
+    signature: fields.signature,
+    tags: fields.tags,
+    payload: {
+      investigationId,
+      hint: fields.hint,
+      topHypothesis: fields.topHypothesisCategory,
+      // First sighting: a single investigation is "recurred 1×". Bumped on each later recurrence.
+      recurrenceCount: 1
+    }
+  };
+  const created = await store.add(item, audit);
+  if (investigationId !== null && investigationId.trim() !== "") {
+    await store.addLink(
+      {
+        id: "",
+        fromMemoryId: created.id,
+        rel: "about-incident",
+        toKind: "incident",
+        toRef: investigationId
+      },
+      { detection: "structural", audit }
+    );
+  }
+  return created;
+}
+async function detectRecurrence(store, probe2, repo) {
+  const r = repo.trim();
+  if (r === "") return null;
+  const existing = await store.query({
+    repo: r,
+    kind: ["investigation"],
+    limit: RECURRENCE_SCAN_LIMIT
+  });
+  for (const candidate of existing) {
+    if (recurrenceReason(candidate, probe2) !== null) return candidate;
+  }
+  return null;
+}
+async function consolidateRecurrence(store, existing, investigationId, fields, reportTime, audit) {
+  const prev = existing.payload ?? {};
+  const recurrenceCount = recurrenceCountOf(prev) + 1;
+  const prevIds = Array.isArray(prev.investigationIds) ? prev.investigationIds.filter((x4) => typeof x4 === "string") : [];
+  const seedIds = prevIds.length > 0 ? prevIds : typeof prev.investigationId === "string" ? [prev.investigationId] : [];
+  const thisId = investigationId !== null && investigationId.trim() !== "" ? investigationId : null;
+  const investigationIds = (thisId !== null ? [...seedIds, thisId] : seedIds).slice(
+    -MAX_INVESTIGATION_IDS
+  );
+  const payload = {
+    ...prev,
+    recurrenceCount,
+    lastSeenAt: reportTime.toISOString(),
+    investigationIds,
+    // Refresh the "latest finding" provenance; keep the original first-seen id for reference.
+    hint: fields.hint,
+    topHypothesis: fields.topHypothesisCategory,
+    investigationId: typeof prev.investigationId === "string" ? prev.investigationId : seedIds[0] ?? thisId
+  };
+  const updated = await store.update(
+    existing.id,
+    {
+      claim: fields.claim,
+      // HONEST: the LATEST report's confidence, verbatim — never inflated, never an average.
+      confidence: fields.confidence,
+      payload
+    },
+    {
+      audit,
+      action: "recurrence",
+      detection: "auto:recurrence-consolidate",
+      detail: { recurrenceCount, ...thisId !== null ? { investigationId: thisId } : {} }
+    }
+  );
+  if (thisId !== null) {
+    await store.addLink(
+      {
+        id: "",
+        fromMemoryId: existing.id,
+        rel: "about-incident",
+        toKind: "incident",
+        toRef: thisId
+      },
+      { detection: "structural", audit }
+    );
+  }
+  return updated;
+}
+async function captureInvestigationMemory(store, investigationId, report, reportTime, audit) {
+  const repo = report.input.repo?.trim() || null;
+  if (repo === null) return { action: "skipped", memoryId: null, recurrenceCount: 0 };
+  const fields = deriveInvestigationFields(report);
+  const existing = await detectRecurrence(
+    store,
+    { signature: fields.signature, tags: fields.tags, claim: fields.claim },
+    repo
+  );
+  if (existing !== null) {
+    const updated = await consolidateRecurrence(
+      store,
+      existing,
+      investigationId,
+      fields,
+      reportTime,
+      audit
+    );
+    return {
+      action: "consolidated",
+      memoryId: updated.id,
+      recurrenceCount: recurrenceCountOf(updated.payload)
+    };
+  }
+  const created = await createInvestigationMemory(store, investigationId, report, audit);
+  return {
+    action: created !== null ? "created" : "skipped",
+    memoryId: created?.id ?? null,
+    recurrenceCount: 1
+  };
+}
+
 // ../../packages/engine/src/gaps.ts
 init_cjs_shims();
 function detectMissingEvidence(r, connectors = {}, mode) {
@@ -94544,6 +95370,46 @@ function looksPerformance(hint) {
     hint
   );
 }
+function looksDurationThemed(hint) {
+  return looksPerformance(hint) || /\b(duration|took|elapsed|anomal(?:y|ies|ous)|spike|variance|regress(?:ion|ed)?|p\d{2})\b/i.test(
+    hint
+  );
+}
+function parseSuggestedCauses(hint) {
+  const SUGGESTIVE = /\b(could indicate|may be|might be|maybe|possibly|suggest(?:s|ing|ed)?|likely (?:caused|due)|points? to|consistent with|indicat(?:es|ive)|appears? to be|seems? to be|probably)\b/i;
+  if (!SUGGESTIVE.test(hint)) return [];
+  const CATEGORY_CUES = [
+    ["deployment-regression", /\b(deploy(?:ment|ed)?|release|rollout|regression|recent change|shipped)\b/i],
+    ["infrastructure", /\b(database|db|infra(?:structure)?|network|cache|disk|memory|cpu|oom|out of memory|connection pool|datastore|redis|mongo|postgres)\b/i],
+    ["external-api-latency", /\b(upstream|external api|third[- ]party|downstream|api latency|timeout|slow (?:api|service)|gateway)\b/i],
+    ["retry-storm", /\b(retr(?:y|ies)|retry storm|thundering herd|amplif)/i],
+    ["queue-backlog", /\b(queue|backlog|consumer lag|enqueue)\b/i],
+    ["worker-slowdown", /\b(worker|consumer)\b/i],
+    ["benign-variance", /\b(per[- ]segment|per[- ]region|skew(?:ed)?|variance|expected variation|noise)\b/i]
+  ];
+  const out2 = [];
+  for (const [category, cue] of CATEGORY_CUES) {
+    if (cue.test(hint)) out2.push(category);
+  }
+  return out2;
+}
+function formatDurationMs(ms) {
+  if (!Number.isFinite(ms) || ms < 0) return "?";
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  const totalSec = ms / 1e3;
+  if (totalSec < 60) {
+    const s5 = Math.round(totalSec * 10) / 10;
+    return `${s5}s`;
+  }
+  const totalMin = Math.floor(totalSec / 60);
+  const remSec = Math.round(totalSec % 60);
+  if (totalMin < 60) {
+    return remSec > 0 ? `${totalMin}m${remSec}s` : `${totalMin}m`;
+  }
+  const h3 = Math.floor(totalMin / 60);
+  const remMin = totalMin % 60;
+  return remMin > 0 ? `${h3}h${remMin}m` : `${h3}h`;
+}
 var SOURCE_IMPACT_RE = [
   /\bwhat depends on\b/i,
   /\bblast[- ]?radius\b/i,
@@ -94694,6 +95560,7 @@ async function investigate(input, deps) {
   const hint = input.hint.trim();
   const intent = classifyIntent(hint, input.since);
   const namedSymbols = parseNamedSymbols(hint);
+  const alertSuggestedCategories = parseSuggestedCauses(hint);
   const sourceImpactHint = intent === "source-impact";
   const preferNamed = sourceImpactHint && namedSymbols.length > 0 ? namedSymbols[0] : void 0;
   const evidence2 = [];
@@ -94858,8 +95725,8 @@ async function investigate(input, deps) {
       // HOR-386 — empty-return: route to `search` for the right name (deterministic).
       nextSteps: route({ command: "investigate", empty: true, query: hint })
     };
-    const persistedId2 = await persist(db, input, report2);
-    if (persistedId2) report2.id = persistedId2;
+    const persistedEmpty = await persist(db, input, report2);
+    if (persistedEmpty) report2.id = persistedEmpty.id;
     return report2;
   }
   let label = input.service ?? hint;
@@ -95018,6 +95885,7 @@ async function investigate(input, deps) {
   const logEvIds = [];
   const directLogEvIds = [];
   const ambientLogEvIds = [];
+  const perDimensionDurationEvIds = [];
   const directSignatures = [];
   const directEvIdByKey = /* @__PURE__ */ new Map();
   const seedEmittedJoins = [];
@@ -95436,6 +96304,55 @@ async function investigate(input, deps) {
       axiomCollected = false;
     }
   }
+  if (looksDurationThemed(hint)) {
+    const from = logWindowFrom(input.logsSince ?? input.since);
+    const baseDurationOpts = input.durationDimension ?? {
+      // Conservative default for the common `Completed <JOB>:<REGION> ~2m10s` shape: extract an
+      // alphanumeric token after a colon as the dimension, scoped to completion lines, parsing
+      // the duration out of the message. A non-matching corpus yields null (graceful).
+      dimension: { name: "region", pattern: ":\\s*([A-Za-z][\\w-]+)" },
+      completionText: "Completed"
+    };
+    const durationOpts = {
+      ...baseDurationOpts,
+      from: baseDurationOpts.from ?? from,
+      ...input.service !== void 0 && baseDurationOpts.service === void 0 ? { service: input.service } : {},
+      level: baseDurationOpts.level ?? "info"
+    };
+    const durationProviders = [];
+    if (deps.logs && typeof deps.logs.analyzeDurations === "function") {
+      durationProviders.push({ source: "elasticsearch", analyze: (o5) => deps.logs.analyzeDurations(o5) });
+    }
+    if (deps.axiom && typeof deps.axiom.analyzeDurations === "function") {
+      durationProviders.push({ source: "axiom", analyze: (o5) => deps.axiom.analyzeDurations(o5) });
+    }
+    for (const provider of durationProviders) {
+      try {
+        const result = await provider.analyze(durationOpts);
+        if (result === null) continue;
+        const values2 = Object.entries(result.byValue);
+        if (values2.length === 0) continue;
+        const summary2 = values2.sort((a2, b5) => b5[1].avg - a2[1].avg).map(([val, st3]) => `${val} ${formatDurationMs(st3.avg)}`).join(", ");
+        const ev = mkEv(
+          "log",
+          `Duration by ${result.dimension}: ${summary2}`.slice(0, 220),
+          {
+            source: provider.source,
+            kind: "duration-by-dimension",
+            dimension: result.dimension,
+            unit: result.unit,
+            byValue: result.byValue,
+            sampleCount: result.sampleCount
+          },
+          {},
+          void 0,
+          0.6
+        );
+        perDimensionDurationEvIds.push(ev.id);
+      } catch {
+      }
+    }
+  }
   let stateAnalysis = null;
   const stateEvIds = [];
   const stateCollections = /* @__PURE__ */ new Set();
@@ -95526,6 +96443,7 @@ async function investigate(input, deps) {
   const METRICS_TIMEOUT_MS = 3e4;
   const metricEvIds = [];
   const latencyMetricEvIds = [];
+  const bimodalMetricEvIds = [];
   const queueMetricEvIds = [];
   const queueMetricEvIdsByQueue = /* @__PURE__ */ new Map();
   const nominalMetricEvIds = [];
@@ -95577,6 +96495,8 @@ async function investigate(input, deps) {
           );
           const genericPerf = serviceFilter.length === 0 && hintIsPerf && f5.anomaly === "latency-spike";
           if (matchesService || matchesHint || genericPerf) latencyMetricEvIds.push(ev.id);
+        } else if (f5.anomaly === "bimodal-population") {
+          bimodalMetricEvIds.push(ev.id);
         } else if (f5.anomaly === "queue-growth") {
           const panelNorm = f5.panelTitle.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
           const labelNorms = Object.values(f5.labels).map(
@@ -95647,7 +96567,13 @@ async function investigate(input, deps) {
     sinceProvided: input.since !== void 0,
     suppressRuntimeHypotheses: sourceImpactHint,
     recentChangeRelevant,
-    graph
+    graph,
+    // HOR-435: per-segment duration breakdown (#2) + bimodal-population metric (#3) support
+    // the benign-variance hypothesis (#4); the suggested categories de-anchor alert text (#1).
+    perDimensionDurationEvIds,
+    bimodalMetricEvIds,
+    benignVarianceApplicable: looksDurationThemed(hint) || perDimensionDurationEvIds.length > 0 || bimodalMetricEvIds.length > 0 || latencyMetricEvIds.length > 0,
+    alertSuggestedCategories
   });
   const validated = validateHypotheses(hyps, evidence2);
   const causeChains = buildCauseChains(validated, evidence2, graph, label);
@@ -96253,13 +97179,26 @@ async function investigate(input, deps) {
     query: hint
   });
   report.sourceStatus = buildRuntimeSourceStatus(evidence2, connectorFlags);
-  const persistedId = await persist(db, input, report);
-  if (persistedId) report.id = persistedId;
+  const persisted = await persist(db, input, report);
+  const persistedId = persisted?.id ?? null;
+  if (persistedId !== null) report.id = persistedId;
   report.persisted = persistedId !== null;
   if (persistedId !== null) {
     const tags = deriveTags(report);
     report.similarIncidents = await recallSimilar(db, tags, persistedId, input.repo ?? null);
     await storeIncidentMemory(db, persistedId, report);
+    const store = deps.store;
+    if (store !== void 0 && autoInvestigationMemoryEnabled()) {
+      try {
+        const audit = {
+          actor: { kind: "system" },
+          note: "auto: investigation memory (HOR-432)"
+        };
+        const reportTime = persisted?.createdAt ?? /* @__PURE__ */ new Date();
+        await captureInvestigationMemory(store, persistedId, report, reportTime, audit);
+      } catch {
+      }
+    }
   }
   if (persistedId !== null) {
     try {
@@ -96303,7 +97242,7 @@ async function persist(db, input, report) {
       incidentInput: input,
       status: "open",
       summary: report.summary
-    }).returning({ id: investigations.id });
+    }).returning({ id: investigations.id, createdAt: investigations.createdAt });
     const row = inserted[0];
     if (!row) return null;
     const investigationId = row.id;
@@ -96347,7 +97286,7 @@ async function persist(db, input, report) {
         }))
       );
     }
-    return investigationId;
+    return { id: investigationId, createdAt: row.createdAt ?? null };
   } catch {
     return null;
   }
@@ -97056,225 +97995,6 @@ function blastRadiusToJSON(r) {
   return JSON.stringify(r, null, 2);
 }
 
-// ../../packages/engine/src/memory-store.ts
-init_cjs_shims();
-var HIDDEN_STATUSES = [
-  "forgotten",
-  "deprecated",
-  "contradicted"
-];
-function tokenize2(text2) {
-  const seen = /* @__PURE__ */ new Set();
-  const out2 = [];
-  for (const raw of text2.toLowerCase().split(/[^a-z0-9]+/)) {
-    if (raw !== "" && !seen.has(raw)) {
-      seen.add(raw);
-      out2.push(raw);
-    }
-  }
-  return out2;
-}
-function scopeSpecificity(scope) {
-  if (scope.startsWith("symbol:")) return 3;
-  if (scope.startsWith("module:")) return 2;
-  if (scope === "repo") return 1;
-  return 0;
-}
-var NoopVectorIndex = class {
-  entries = /* @__PURE__ */ new Map();
-  async upsert(i3) {
-    this.entries.set(i3.memoryId, {
-      memoryId: i3.memoryId,
-      repo: i3.repo,
-      scope: i3.scope,
-      tokens: tokenize2(i3.claim)
-    });
-  }
-  async search(i3) {
-    const repo = i3.repo.trim();
-    if (repo === "") return [];
-    const queryTokens = tokenize2(i3.query);
-    if (queryTokens.length === 0) return [];
-    const scored = [...this.entries.values()].filter((e) => e.repo === repo).map((e) => ({
-      memoryId: e.memoryId,
-      score: tagOverlap(queryTokens, e.tokens),
-      specificity: scopeSpecificity(e.scope)
-    })).filter((h3) => h3.score > 0).sort(
-      (a2, b5) => b5.score - a2.score || b5.specificity - a2.specificity || (a2.memoryId < b5.memoryId ? -1 : a2.memoryId > b5.memoryId ? 1 : 0)
-    );
-    const limit = Number.isFinite(i3.limit) && i3.limit > 0 ? Math.floor(i3.limit) : scored.length;
-    return scored.slice(0, limit).map((h3) => ({ memoryId: h3.memoryId, score: h3.score }));
-  }
-  async remove(memoryId) {
-    this.entries.delete(memoryId);
-  }
-};
-
-// ../../packages/engine/src/memory-detect.ts
-init_cjs_shims();
-var import_node_crypto3 = require("crypto");
-var TAG_OVERLAP_MIN = 0.6;
-var CLAIM_JACCARD_MIN = 0.6;
-var MIN_CLAIM_TOKENS = 4;
-var INCIDENT_DERIVED_KINDS2 = /* @__PURE__ */ new Set([
-  "confirmed-outcome",
-  "incident-pattern"
-]);
-function usableSignature(sig) {
-  const s5 = (sig ?? "").trim();
-  if (s5 === "" || /^\|*$/.test(s5)) return null;
-  const components = s5.split(/[|,]/).map((c4) => c4.trim()).filter((c4) => c4 !== "");
-  if (components.length === 0) return null;
-  if (components.every((c4) => isGenericTag(c4))) return null;
-  return s5;
-}
-function sharedNonGenericTags(a2, b5) {
-  const setB = new Set(b5);
-  const seen = /* @__PURE__ */ new Set();
-  const out2 = [];
-  for (const t2 of a2) {
-    if (setB.has(t2) && !isGenericTag(t2) && !seen.has(t2)) {
-      seen.add(t2);
-      out2.push(t2);
-    }
-  }
-  return out2;
-}
-function recurrenceEdgeId(idA, idB) {
-  const [lo, hi] = idA <= idB ? [idA, idB] : [idB, idA];
-  const h3 = (0, import_node_crypto3.createHash)("sha256").update(`recurs-with\0${lo}\0${hi}`).digest("hex");
-  return `lnk_recurs_${h3.slice(0, 32)}`;
-}
-function normalizeCause(s5) {
-  return (s5 ?? "").trim().toLowerCase().replace(/\s+/g, " ");
-}
-function outcomeConflict(a2, b5) {
-  const opposite = a2.resolved === "yes" && b5.resolved === "no" || a2.resolved === "no" && b5.resolved === "yes";
-  if (opposite) {
-    return `outcome verdicts disagree (${a2.resolved} vs ${b5.resolved})`;
-  }
-  const ca = normalizeCause(a2.confirmedCause);
-  const cb = normalizeCause(b5.confirmedCause);
-  if (ca !== "" && cb !== "" && ca !== cb) {
-    return `confirmed causes differ ("${a2.confirmedCause}" vs "${b5.confirmedCause}")`;
-  }
-  return null;
-}
-function recurrenceReason(a2, b5) {
-  const sigA = usableSignature(a2.signature);
-  const sigB = usableSignature(b5.signature);
-  if (sigA !== null && sigB !== null && sigA === sigB) {
-    return `identical incident signature "${sigA}"`;
-  }
-  const tagsA = a2.tags ?? [];
-  const tagsB = b5.tags ?? [];
-  const shared = sharedNonGenericTags(tagsA, tagsB);
-  const overlap = tagOverlap([...tagsA], [...tagsB]);
-  if (overlap >= TAG_OVERLAP_MIN && shared.length >= 1) {
-    return `tag overlap ${overlap.toFixed(2)} on [${shared.join(", ")}]`;
-  }
-  if (sigA === null && sigB === null && shared.length >= 1) {
-    const ta = tokenize2(a2.claim);
-    const tb = tokenize2(b5.claim);
-    if (ta.length >= MIN_CLAIM_TOKENS && tb.length >= MIN_CLAIM_TOKENS) {
-      const j3 = tagOverlap(ta, tb);
-      if (j3 >= CLAIM_JACCARD_MIN) {
-        return `claim similarity ${j3.toFixed(2)} corroborated by [${shared.join(", ")}]`;
-      }
-    }
-  }
-  return null;
-}
-function edgeKey(rel, from, to) {
-  if (rel === "recurs-with" || rel === "contradicts") {
-    const [lo, hi] = from <= to ? [from, to] : [to, from];
-    return `${rel}|${lo}|${hi}`;
-  }
-  return `${rel}|${from}|${to}`;
-}
-async function detectMemoryEdges(store, opts, deps = {}) {
-  const repo = opts.repo.trim();
-  if (repo === "") return [];
-  const items = await store.query({ repo, limit: opts.limit ?? 1e3 });
-  const candidates = items.filter((i3) => INCIDENT_DERIVED_KINDS2.has(i3.kind));
-  if (candidates.length < 2) return [];
-  const existing = /* @__PURE__ */ new Set();
-  const investigationOf = /* @__PURE__ */ new Map();
-  for (const item of candidates) {
-    const out2 = await store.links(item.id, { direction: "out" });
-    for (const l2 of out2) {
-      if (l2.toKind === "memory") {
-        existing.add(edgeKey(l2.rel, l2.fromMemoryId, l2.toRef));
-      } else if (l2.toKind === "incident" && l2.rel === "about-incident") {
-        if (!investigationOf.has(item.id)) investigationOf.set(item.id, l2.toRef);
-      }
-    }
-  }
-  const proposals = [];
-  const outcomeCache = /* @__PURE__ */ new Map();
-  const resolveOutcome = async (investigationId) => {
-    if (deps.outcomeFor === void 0) return null;
-    if (outcomeCache.has(investigationId)) return outcomeCache.get(investigationId) ?? null;
-    let v4 = null;
-    try {
-      v4 = await deps.outcomeFor(investigationId);
-    } catch {
-      v4 = null;
-    }
-    outcomeCache.set(investigationId, v4);
-    return v4;
-  };
-  for (let i3 = 0; i3 < candidates.length; i3++) {
-    const a2 = candidates[i3];
-    for (let j3 = i3 + 1; j3 < candidates.length; j3++) {
-      const b5 = candidates[j3];
-      if (!existing.has(edgeKey("recurs-with", a2.id, b5.id))) {
-        const reason = recurrenceReason(a2, b5);
-        if (reason !== null) {
-          const [lo, hi] = a2.id <= b5.id ? [a2.id, b5.id] : [b5.id, a2.id];
-          proposals.push({
-            id: recurrenceEdgeId(a2.id, b5.id),
-            fromMemoryId: lo,
-            toMemoryId: hi,
-            rel: "recurs-with",
-            detection: "auto:recurrence",
-            reason
-          });
-        }
-      }
-      if (deps.outcomeFor !== void 0 && a2.kind === "confirmed-outcome" && b5.kind === "confirmed-outcome" && !existing.has(edgeKey("contradicts", a2.id, b5.id))) {
-        const sigA = usableSignature(a2.signature);
-        const sigB = usableSignature(b5.signature);
-        const invA = investigationOf.get(a2.id);
-        const invB = investigationOf.get(b5.id);
-        if (sigA !== null && sigA === sigB && invA !== void 0 && invB !== void 0) {
-          const oa = await resolveOutcome(invA);
-          const ob = await resolveOutcome(invB);
-          if (oa !== null && ob !== null) {
-            const reason = outcomeConflict(oa, ob);
-            if (reason !== null) {
-              const [lo, hi] = a2.id <= b5.id ? [a2.id, b5.id] : [b5.id, a2.id];
-              const invLo = lo === a2.id ? invA : invB;
-              const invHi = lo === a2.id ? invB : invA;
-              proposals.push({
-                id: "",
-                // directional — the store mints the id
-                fromMemoryId: lo,
-                toMemoryId: hi,
-                rel: "contradicts",
-                detection: "auto:contradiction",
-                reason,
-                detail: { investigationIds: [invLo, invHi] }
-              });
-            }
-          }
-        }
-      }
-    }
-  }
-  return proposals;
-}
-
 // ../../packages/engine/src/memory-recall.ts
 init_cjs_shims();
 var import_node_crypto4 = require("crypto");
@@ -101915,8 +102635,13 @@ async function runIndex(opts) {
         console.error(import_picocolors6.default.red(`  ${err2.message}`));
         return 1;
       }
-      if (!isAnalyzed(root)) {
-        console.log(import_picocolors6.default.dim("  analyzing with source-intelligence backend (first time \u2014 this can take a while)\u2026"));
+      const staleReason = isAnalyzed(root) ? indexNeedsReanalyze(root) : null;
+      if (!isAnalyzed(root) || staleReason) {
+        console.log(
+          import_picocolors6.default.dim(
+            staleReason ? `  existing index is stale (${staleReason}) \u2014 re-analyzing with source-intelligence backend\u2026` : "  analyzing with source-intelligence backend (first time \u2014 this can take a while)\u2026"
+          )
+        );
         try {
           await analyzeRepo(root);
         } catch (err2) {
@@ -115375,6 +116100,9 @@ async function runOneInvestigation(input, ctx, opts = {}) {
     {
       code: ctx.code,
       db: ctx.dbHandle.db,
+      // HOR-432 — the authored-memory store so every investigation auto-captures a recurrence-aware
+      // memory. Best-effort + CONTEXT-ONLY in the engine (never feeds scoring, never blocks delivery).
+      store: createLocalMemoryStore(ctx.dbHandle.db),
       logs: ctx.logs,
       mongo: ctx.mongo,
       postgres: ctx.postgres,
@@ -117432,6 +118160,39 @@ function createCloudMemoryStore(client, cfg) {
         tags: null
       };
     },
+    // HOR-432 consolidation mirror: refresh the scalar fields the cloud accepts (claim/confidence).
+    // PRIVACY: `payload` NEVER leaves the device (it can stash a vector) — it is intentionally dropped
+    // here, exactly like `add`/`toSyncInput`. The return is the server echo (or a synthesized stub) and
+    // is only consumed by the dual-write wrapper, which discards it; reads always come from local.
+    async update(id, patch, _opts) {
+      const input = { clientId: id };
+      if (patch.claim !== void 0) input.claim = patch.claim;
+      if (patch.confidence !== void 0) input.confidence = patch.confidence;
+      const res = await client.syncMemoryItems(projectId, { items: [input] });
+      const record2 = res.items?.find((r) => r.clientId === id);
+      if (record2) return fromWire(record2, repoFallback);
+      return {
+        id,
+        kind: "investigation",
+        claim: patch.claim ?? "",
+        scope: "repo",
+        source: "investigation",
+        evidence: [],
+        confidence: patch.confidence ?? 0,
+        status: "fresh",
+        createdAt: /* @__PURE__ */ new Date(),
+        lastVerifiedAt: null,
+        lastVerifiedHash: null,
+        orgId: null,
+        workspaceId: null,
+        repo: repoFallback,
+        userId: null,
+        visibility: "private",
+        payload: null,
+        signature: null,
+        tags: null
+      };
+    },
     async get(id) {
       try {
         return await findInList(id);
@@ -117539,6 +118300,14 @@ function dualWriteMemoryStore(local, cloud, onCloudError = () => {
       });
       return row;
     },
+    async update(id, patch, opts) {
+      const row = await local.update(id, patch, opts);
+      await mirror(async () => {
+        await cloud.update(id, patch, opts);
+        await mirrorLatestAudit(id);
+      });
+      return row;
+    },
     async setStatus(id, status, audit) {
       await local.setStatus(id, status, audit);
       await mirror(async () => {
@@ -118932,6 +119701,8 @@ function anomalyLabel2(anomaly) {
       return "QUEUE-GROWTH";
     case "change":
       return "CHANGE";
+    case "bimodal-population":
+      return "BIMODAL-POPULATION";
     case "none":
       return "OK";
   }