hippo-memory 1.29.0 → 1.31.0

package/dist/memory-value.js

@@ -0,0 +1,255 @@
+/**
+ * LC2-E3 — learned memory-value scorer, wired into the sleep decay pass as a
+ * rescue-only veto (design D1/D2, docs/plans/2026-08-10-lc2-e3-mv-wiring.md).
+ *
+ * computeMvFeatures mirrors benchmarks/memory-value/extract.mjs's
+ * computeFeatures for the 8 live dims the E2 fitter optimized over
+ * (FIT_DIMS) — the only dims MEMORY_VALUE_WEIGHTS carries a weight for.
+ * Any future edit to either side must keep them byte-equivalent; the parity
+ * test in tests/memory-value-wiring.test.ts enforces this.
+ *
+ * scoreEntries mirrors benchmarks/memory-value/evaluate.mjs's per-store
+ * min-max normalization + weighted scorer (no additional orientation
+ * multiply — the frozen weights already encode sign/orientation).
+ *
+ * rescueSet implements D1's rescue-only semantics: a condemned entry is
+ * rescued iff its learned score ranks in the top 30% (RESCUE_BUDGET, the E2
+ * keep-budget operating point) of its own tenant's non-pinned candidate set
+ * (D2). Deletes(flag-on) subset Deletes(flag-off) by construction — this
+ * function can only ever shrink the condemned set, never grow it.
+ */
+import { calculateStrength } from './memory.js';
+import { compareEntryIdentity } from './compare.js';
+import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
+/** The 8 live feature dims (FIT_DIMS) — canonical order for iteration. */
+export const MV_FEATURE_NAMES = [
+    'age_days',
+    'half_life_days',
+    'strength',
+    'retrieval_count',
+    'outcome_positive',
+    'outcome_negative',
+    'outcome_ratio',
+    'content_length',
+];
+/** The E2 keep-budget operating point (the only point with measured
+ *  evidence) — a code constant tied to that evidence, not user-tunable. */
+const RESCUE_BUDGET = 0.3;
+/**
+ * Review-round F1 (small-tenant degeneracy): below this per-tenant
+ * non-pinned candidate-set size, a rank statistic is noise — E2's evidence
+ * says nothing about tiny scale — and the floor prevents immortal-entry
+ * convergence: keepN=ceil(0.3*N) guarantees >=1 rescue at N=1, so without a
+ * floor a condemned-only 1-entry tenant would be rescued every single sleep
+ * forever. A condemned-only tenant below the floor instead drains normally
+ * as entries are deleted: the surviving rescued subset only ever shrinks
+ * toward 0, never regrows past 10 to regain eligibility on its own. Code
+ * constant tied to that reasoning, not user-tunable (same posture as
+ * RESCUE_BUDGET).
+ */
+const MIN_RESCUE_GROUP = 10;
+/**
+ * Blind v1 feature dict for one MemoryEntry, restricted to the 8 dims the
+ * frozen weights carry (mirrors extract.mjs's computeFeatures).
+ *
+ * CRITICAL: `strength` is CLOCK-BASIS `calculateStrength(entry, now)` with
+ * NO DecayOptions — that is how the frozen weights' training features were
+ * computed (extract.mjs never passes decayOpts). Passing the production
+ * decay basis (config.decayBasis via consolidate.ts's decayOpts) into this
+ * feature would silently break parity with the frozen weight vector. This
+ * is an intentional divergence from the condemnation TRIGGER in
+ * consolidate.ts, which keeps using decayOpts as today — only the rescue
+ * FEATURE is clock-basis.
+ */
+export function computeMvFeatures(entry, now) {
+    const ageDays = (now.getTime() - Date.parse(entry.created)) / (1000 * 60 * 60 * 24);
+    const pos = entry.outcome_positive ?? 0;
+    const neg = entry.outcome_negative ?? 0;
+    return {
+        age_days: ageDays,
+        half_life_days: entry.half_life_days,
+        strength: calculateStrength(entry, now), // clock-basis, never decayOpts — see doc comment above
+        retrieval_count: entry.retrieval_count,
+        outcome_positive: pos,
+        outcome_negative: neg,
+        outcome_ratio: (pos - neg) / (pos + neg + 1), // same formula as extract.mjs / calculateRewardFactor's ratio term
+        content_length: entry.content.length,
+    };
+}
+/**
+ * Throws if the weight constant is malformed: fewer/extra dims, a
+ * non-finite weight value, or a missing source digest. Flag-on + a broken
+ * constant must THROW, never silently behave as flag-off.
+ *
+ * Parameterized (defaults to the real frozen singleton) so the throw
+ * conditions are directly unit-testable without mutating the frozen
+ * MEMORY_VALUE_WEIGHTS export — mirrors fit.mjs's verifyFrozenWeights
+ * (see tests/memory-value-fit.test.ts's `describe('verifyFrozenWeights')`).
+ */
+export function validateWeights(weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256) {
+    for (const key of MV_FEATURE_NAMES) {
+        const v = weights[key];
+        if (typeof v !== 'number' || !Number.isFinite(v)) {
+            throw new Error(`memory-value: weights constant is malformed — "${key}" is not a finite number ` +
+                `(src/memory-value-weights.ts)`);
+        }
+    }
+    if (typeof digest !== 'string' || digest.length === 0) {
+        throw new Error('memory-value: weights constant is malformed — SOURCE_ARTIFACT_SHA256 digest missing (src/memory-value-weights.ts)');
+    }
+}
+/**
+ * Min-max normalize each of the 8 features over the given entry set
+ * (constant feature -> 0, matching evaluate.mjs), then score = dot(weights,
+ * normalized). The normalization context is exactly the entries passed in —
+ * callers control the bounded scope (D2: per-tenant, non-pinned).
+ *
+ * `weights` defaults to the real frozen singleton; parameterized (like
+ * validateWeights) so callers/tests can score against an explicit vector
+ * without touching the module singleton.
+ *
+ * Review-round F2 (non-finite features): Date.parse on a malformed `created`
+ * string yields NaN, and NaN would silently corrupt every OTHER entry's
+ * min-max in the same group. An entry with ANY non-finite computed feature
+ * is excluded from the normalization context entirely (its raw values never
+ * touch min/max) and always scores -Infinity — the lowest possible score, so
+ * it sorts to the bottom of its tenant deterministically and (via rescueSet's
+ * explicit finite-score guard below) can never be rescued. Conservative
+ * direction: deletes(flag-on) subset deletes(flag-off) still holds.
+ */
+export function scoreEntries(entries, now, weights = MEMORY_VALUE_WEIGHTS) {
+    const raw = new Map();
+    for (const e of entries)
+        raw.set(e.id, computeMvFeatures(e, now));
+    const nonFiniteIds = new Set();
+    for (const e of entries) {
+        const nf = raw.get(e.id);
+        if (MV_FEATURE_NAMES.some((f) => !Number.isFinite(nf[f])))
+            nonFiniteIds.add(e.id);
+    }
+    const normContextEntries = entries.filter((e) => !nonFiniteIds.has(e.id));
+    const minMax = new Map();
+    for (const f of MV_FEATURE_NAMES) {
+        let min = Infinity;
+        let max = -Infinity;
+        for (const e of normContextEntries) {
+            const v = raw.get(e.id)[f];
+            if (v < min)
+                min = v;
+            if (v > max)
+                max = v;
+        }
+        minMax.set(f, { min, max });
+    }
+    const norm = (f, v) => {
+        const { min, max } = minMax.get(f);
+        return max === min ? 0 : (v - min) / (max - min);
+    };
+    const scores = new Map();
+    for (const e of entries) {
+        if (nonFiniteIds.has(e.id)) {
+            scores.set(e.id, -Infinity);
+            continue;
+        }
+        const nf = raw.get(e.id);
+        let sum = 0;
+        for (const f of MV_FEATURE_NAMES)
+            sum += weights[f] * norm(f, nf[f]);
+        scores.set(e.id, sum);
+    }
+    return scores;
+}
+/**
+ * Groups non-pinned entries by tenantId (D2), scores + ranks each tenant's
+ * group independently, and returns per-entry rank context for every
+ * non-pinned entry (not just condemned ones) — the shared basis for both
+ * rescueSet's rescue decision and consolidate.ts's audit-row rank context,
+ * so the two never compute the ranking differently.
+ *
+ * `weights`/`digest` default to the real frozen singleton — parameterized
+ * (like validateWeights/scoreEntries) purely for direct unit-testability of
+ * the fail-loud path, never overridden by production callers.
+ */
+export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256) {
+    validateWeights(weights, digest);
+    const byTenant = new Map();
+    for (const e of entries) {
+        if (e.pinned)
+            continue; // D2: pinned entries never compete for rescue (never condemned)
+        // F9: guard undefined tenantId the same way dag.ts:341 does — the
+        // MemoryEntry type says `string`, but a raw/legacy row can still carry
+        // undefined at runtime, and grouping it under the literal key
+        // "undefined" would silently split it into its own singleton tenant.
+        const tenantId = e.tenantId ?? 'default';
+        const list = byTenant.get(tenantId);
+        if (list)
+            list.push(e);
+        else
+            byTenant.set(tenantId, [e]);
+    }
+    const result = new Map();
+    for (const [tenantId, group] of byTenant) {
+        const scores = scoreEntries(group, now, weights);
+        // score DESC -> compareEntryIdentity (content asc -> id asc), the shared
+        // deterministic tie-break used by every score-primary sort site in this
+        // codebase (src/compare.ts). F2: `-Infinity - -Infinity` is NaN, not 0 —
+        // two non-finite-feature entries tied at -Infinity would otherwise fall
+        // through to `diff` (NaN), which Array.sort treats as "no preference"
+        // and leaves insertion-order-dependent. Route NaN through the same
+        // deterministic tie-break as an exact-zero diff.
+        const sorted = [...group].sort((a, b) => {
+            const diff = scores.get(b.id) - scores.get(a.id);
+            return diff === 0 || Number.isNaN(diff) ? compareEntryIdentity(a, b) : diff;
+        });
+        // F1: tenants smaller than MIN_RESCUE_GROUP never rescue (keepN 0) — see
+        // that constant's doc comment.
+        const keepN = sorted.length < MIN_RESCUE_GROUP
+            ? 0
+            : Math.min(sorted.length, Math.ceil(RESCUE_BUDGET * sorted.length));
+        sorted.forEach((e, i) => {
+            result.set(e.id, {
+                tenantId,
+                score: scores.get(e.id),
+                rank: i + 1,
+                totalNonPinned: sorted.length,
+                keepN,
+            });
+        });
+    }
+    return result;
+}
+/**
+ * D1 rescue decision: a condemned entry is rescued iff it ranks in the top
+ * 30% of its tenant's non-pinned candidate set by learned score. Returns the
+ * subset of condemnedIds that are rescued — the caller filters commits
+ * (rescued -> survivors) and threads the same set into detectConflicts.
+ *
+ * `weights`/`digest` default to the real frozen singleton; production
+ * callers (consolidate.ts) never pass overrides — the params exist purely so
+ * "flag on + a broken constant throws" is directly testable end-to-end
+ * through this function without mutating the frozen module singleton.
+ *
+ * `precomputedRanks` (round-2 code-review P2-2): when the caller has already
+ * computed the per-tenant ranking (e.g. consolidate.ts needs it separately
+ * for detail/audit rank context), pass it here to skip the internal
+ * rankNonPinnedByTenant call — the whole-store ranking pass then runs
+ * exactly once per sleep instead of twice. Omitted (the default), rescueSet
+ * computes it internally as before — existing callers/tests are unaffected.
+ */
+export function rescueSet(entries, condemnedIds, now, weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256, precomputedRanks) {
+    validateWeights(weights, digest); // fail loud before any rescue computation (constraint 5)
+    const ranked = precomputedRanks ?? rankNonPinnedByTenant(entries, now, weights, digest);
+    const rescued = new Set();
+    for (const id of condemnedIds) {
+        const info = ranked.get(id);
+        // F2: Number.isFinite(info.score) is an explicit, absolute guard — not
+        // just reliance on -Infinity naturally sorting last. In the degenerate
+        // case where every entry in a tenant is non-finite-scored (a tie at
+        // -Infinity), rank position alone could otherwise place one inside
+        // keepN; this makes "never rescued" hold regardless.
+        if (info && info.rank <= info.keepN && Number.isFinite(info.score))
+            rescued.add(id);
+    }
+    return rescued;
+}
+//# sourceMappingURL=memory-value.js.map

package/dist/memory-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-value.js","sourceRoot":"","sources":["../src/memory-value.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEzF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAyC;IACpE,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;CACjB,CAAC;AAEF;2EAC2E;AAC3E,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAa5B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAkB,EAAE,GAAS;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,uDAAuD;QAChG,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,GAAG;QACrB,aAAa,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,mEAAmE;QACjH,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA4C,oBAAoB,EAChE,SAAiB,sBAAsB;IAEvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,2BAA2B;gBAChF,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAsB,EACtB,GAAS,EACT,UAA4C,oBAAoB;IAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;QAC1B,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,IAAI,GAAG,GAAG,QAAQ,CAAC;QACnB,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAwB,EAAE,CAAS,EAAU,EAAE;QAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACpC,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;QAC1B,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,gBAAgB;YAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,GAAS,EACT,UAA4C,oBAAoB,EAChE,SAAiB,sBAAsB;IAEvC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS,CAAC,gEAAgE;QACxF,kEAAkE;QAClE,uEAAuE;QACvE,8DAA8D;QAC9D,qEAAqE;QACrE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,iDAAiD;QACjD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;YACnD,OAAO,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,gBAAgB;YAC5C,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACf,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE;gBACxB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,MAAM,CAAC,MAAM;gBAC7B,KAAK;aACN,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CACvB,OAAsB,EACtB,YAAyB,EACzB,GAAS,EACT,UAA4C,oBAAoB,EAChE,SAAiB,sBAAsB,EACvC,gBAA0C;IAE1C,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,yDAAyD;IAC3F,MAAM,MAAM,GAAG,gBAAgB,IAAI,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/reject-flow.d.ts

@@ -0,0 +1,66 @@
+/**
+ * AT1 rejected-value tombstone — shared reject/unreject/list flow.
+ * docs/plans/2026-08-15-at1-rejected-value-tombstone.md (T2, plan §4).
+ *
+ * The CLI (`hippo reject`/`rejections`/`unreject`) and the Context-based
+ * `api.reject`/`api.unreject`/`api.listRejections` surfaces both need the
+ * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
+ * here (leaf module) so neither duplicates it.
+ *
+ * Module direction: this file imports from store.ts, rejection.ts, and
+ * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
+ * so it introduces no cycle.
+ */
+import { type RejectedValueRow } from './rejection.js';
+export interface RejectFlowOpts {
+    hippoRoot: string;
+    tenantId: string;
+    actor: string;
+    reason: string;
+    /** By-id form: reject the CURRENT content of an existing memory. */
+    memoryId?: string;
+    /** Pre-emptive form: reject a value not currently stored (or already gone). */
+    value?: string;
+}
+export interface RejectFlowResult {
+    digest: string;
+    /** The rejected content, for the CLI's at-reject-time echo (plan §2: the
+     *  tombstone itself stores no content — this is the only place it's seen
+     *  again after this call returns). */
+    content: string;
+    /** Every live row removed this call (all tenant rows whose normalized
+     *  digest matched — not just the id passed, per the K1/R7 duplicate
+     *  lesson). */
+    removedIds: string[];
+    /** Subset of removedIds that were kind='raw' (archived, not deleted). */
+    removedRawIds: string[];
+}
+/**
+ * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
+ * insert the tombstone, enumerate + remove every live tenant row whose
+ * normalized digest matches (kind-aware), one aggregate `reject_value`
+ * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
+ * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
+ * index mirror rewrite.
+ */
+export declare function rejectValue(opts: RejectFlowOpts): RejectFlowResult;
+export type UnrejectOutcome = {
+    status: 'ok';
+    digest: string;
+    reason: string | null;
+} | {
+    status: 'not_found';
+} | {
+    status: 'ambiguous';
+    candidates: RejectedValueRow[];
+};
+/**
+ * `hippo unreject` / `api.unreject` — resolve a unique tombstone by digest
+ * (or prefix), delete it, audit `unreject_value`. The only v1 escape hatch
+ * (plan §4): no per-write force flag.
+ */
+export declare function unrejectValue(hippoRoot: string, tenantId: string, digestOrPrefix: string, actor: string): UnrejectOutcome;
+/** `hippo rejections` / `api.listRejections` — list tombstones for a tenant. */
+export declare function listRejectionsForTenant(hippoRoot: string, tenantId: string): RejectedValueRow[];
+//# sourceMappingURL=reject-flow.d.ts.map

package/dist/reject-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reject-flow.d.ts","sourceRoot":"","sources":["../src/reject-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;0CAEsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB;;mBAEe;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yEAAyE;IACzE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAgIlE;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,GACZ,eAAe,CAmCjB;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAQ/F"}

package/dist/reject-flow.js

@@ -0,0 +1,207 @@
+/**
+ * AT1 rejected-value tombstone — shared reject/unreject/list flow.
+ * docs/plans/2026-08-15-at1-rejected-value-tombstone.md (T2, plan §4).
+ *
+ * The CLI (`hippo reject`/`rejections`/`unreject`) and the Context-based
+ * `api.reject`/`api.unreject`/`api.listRejections` surfaces both need the
+ * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
+ * here (leaf module) so neither duplicates it.
+ *
+ * Module direction: this file imports from store.ts, rejection.ts, and
+ * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
+ * so it introduces no cycle.
+ */
+import { openHippoDb, closeHippoDb } from './db.js';
+import { appendAuditEvent } from './audit.js';
+import { archiveRawMemory } from './raw-archive.js';
+import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
+import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
+/**
+ * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
+ * insert the tombstone, enumerate + remove every live tenant row whose
+ * normalized digest matches (kind-aware), one aggregate `reject_value`
+ * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
+ * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
+ * index mirror rewrite.
+ */
+export function rejectValue(opts) {
+    if (!opts.reason.trim()) {
+        throw new Error('reject requires a non-empty --reason (the tombstone stores no content; reason is its only identity).');
+    }
+    if (opts.memoryId === undefined && opts.value === undefined) {
+        throw new Error('reject requires either a memory id or --value.');
+    }
+    if (opts.memoryId !== undefined && opts.value !== undefined) {
+        // P2 fix: the CLI's flag parser already refuses both forms together;
+        // the shared flow itself didn't enforce it, so a direct api caller
+        // passing both silently got the memoryId path with `value` ignored —
+        // surprising for a caller who thought they were rejecting `value`.
+        throw new Error('reject accepts either a memory id or --value, not both.');
+    }
+    if (opts.value !== undefined && normalizeValueForRejection(opts.value).length === 0) {
+        // Direct api callers can pass strings the CLI flag parser would have
+        // refused; an empty-normalized tombstone would refuse nothing meaningful
+        // and pollute the listing.
+        throw new Error('reject --value requires non-empty content.');
+    }
+    initStore(opts.hippoRoot);
+    const db = openHippoDb(opts.hippoRoot);
+    try {
+        let content;
+        if (opts.memoryId !== undefined) {
+            const row = db
+                .prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`)
+                .get(opts.memoryId);
+            if (!row || row.tenant_id !== opts.tenantId) {
+                throw new Error(`memory not found: ${opts.memoryId}`);
+            }
+            content = row.content;
+        }
+        else {
+            content = opts.value;
+        }
+        const digest = rejectionDigest(content);
+        const now = new Date().toISOString();
+        const removedIds = [];
+        const removedRawIds = [];
+        db.exec('BEGIN');
+        try {
+            insertRejectedValue(db, {
+                tenantId: opts.tenantId,
+                digest,
+                reason: opts.reason,
+                rejectedBy: opts.actor,
+                rejectedAt: now,
+                sourceMemoryId: opts.memoryId ?? null,
+                normalizedChars: normalizeValueForRejection(content).length,
+            });
+            // O(N) scan over the tenant's rows (plan §4): human-triggered command
+            // on ~1-5k-row stores — acceptable, documented. A digest column on
+            // memories is the escape if stores grow 100x; not needed now.
+            const rows = db
+                .prepare(`SELECT id, kind, content FROM memories WHERE tenant_id = ?`)
+                .all(opts.tenantId);
+            for (const row of rows) {
+                if (rejectionDigest(row.content) !== digest)
+                    continue;
+                if (row.kind === 'raw') {
+                    // Append-only trigger respected — archiveRawMemory is the only
+                    // legitimate removal path for kind='raw', and its inner SAVEPOINT
+                    // composes safely inside this BEGIN/COMMIT.
+                    archiveRawMemory(db, row.id, { reason: opts.reason, who: opts.actor });
+                    removedRawIds.push(row.id);
+                }
+                else {
+                    // suppressForgetAudit: the aggregate reject_value row below is the
+                    // trail for these removals, not N individual forget rows (plan
+                    // §4, round-3 advisory 2 — mirrors api.ts:1873-1877).
+                    deleteEntryCore(db, row.id, { actor: opts.actor, suppressForgetAudit: true });
+                }
+                removedIds.push(row.id);
+            }
+            try {
+                appendAuditEvent(db, {
+                    tenantId: opts.tenantId,
+                    actor: opts.actor,
+                    op: 'reject_value',
+                    targetId: opts.memoryId,
+                    metadata: { digest, removedIds, count: removedIds.length },
+                });
+            }
+            catch {
+                // Best-effort — mirrors store.ts's private audit() semantics. This
+                // runs INSIDE the still-open transaction (COMMIT is the next
+                // statement): a swallowed audit failure lets the tombstone +
+                // removals commit without the trail row, rather than rolling the
+                // whole reject back over bookkeeping.
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch {
+                // already rolled back
+            }
+            throw err;
+        }
+        // Post-commit, db handle still open (same pattern as api.archiveRaw):
+        // best-effort mirror purge per removed id, reaper-backstop stamp for
+        // raw ids, one index mirror rewrite.
+        for (const id of removedIds) {
+            // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
+            // which cleanupArchivedMirrors' reaper never scans — reports the
+            // EXPLICIT leftover path(s) instead of the false "will retry via
+            // reaper" claim. See its own doc comment (store.ts, near
+            // removeEntryMirrors) for the full rationale.
+            const mirrorOk = purgeMirrorBestEffort(opts.hippoRoot, id, removedRawIds.includes(id), 'hippo reject');
+            if (mirrorOk && removedRawIds.includes(id)) {
+                db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
+            }
+        }
+        if (removedIds.length > 0) {
+            writeIndexMirror(opts.hippoRoot, buildIndexFromDb(db));
+        }
+        return { digest, content, removedIds, removedRawIds };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/**
+ * `hippo unreject` / `api.unreject` — resolve a unique tombstone by digest
+ * (or prefix), delete it, audit `unreject_value`. The only v1 escape hatch
+ * (plan §4): no per-write force flag.
+ */
+export function unrejectValue(hippoRoot, tenantId, digestOrPrefix, actor) {
+    // P2 fix: an empty/blank prefix startsWith-matches EVERY digest (every
+    // string starts with ''), which would previously fall through to the
+    // ambiguous-candidates branch and list the whole tombstone set instead of
+    // failing loud on the actually-invalid input. Reject before the DB round
+    // trip.
+    if (digestOrPrefix.trim().length === 0) {
+        return { status: 'not_found' };
+    }
+    initStore(hippoRoot);
+    const db = openHippoDb(hippoRoot);
+    try {
+        const all = listRejectedValues(db, tenantId);
+        const matches = all.filter((r) => r.digest.startsWith(digestOrPrefix));
+        if (matches.length === 0)
+            return { status: 'not_found' };
+        if (matches.length > 1)
+            return { status: 'ambiguous', candidates: matches };
+        const target = matches[0];
+        deleteRejectedValue(db, tenantId, target.digest);
+        try {
+            appendAuditEvent(db, {
+                tenantId,
+                actor,
+                op: 'unreject_value',
+                targetId: target.sourceMemoryId ?? undefined,
+                metadata: { digest: target.digest, reason: target.reason },
+            });
+        }
+        catch {
+            // Best-effort, same as reject's audit call above.
+        }
+        return { status: 'ok', digest: target.digest, reason: target.reason };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** `hippo rejections` / `api.listRejections` — list tombstones for a tenant. */
+export function listRejectionsForTenant(hippoRoot, tenantId) {
+    initStore(hippoRoot);
+    const db = openHippoDb(hippoRoot);
+    try {
+        return listRejectedValues(db, tenantId);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=reject-flow.js.map

package/dist/reject-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reject-flow.js","sourceRoot":"","sources":["../src/reject-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AA2BxB;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,qEAAqE;QACrE,yEAAyE;QACzE,2BAA2B;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,OAAe,CAAC;QACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,EAAE;iBACX,OAAO,CAAC,sDAAsD,CAAC;iBAC/D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAuD,CAAC;YAC5E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC,KAAM,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,mBAAmB,CAAC,EAAE,EAAE;gBACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,KAAK;gBACtB,UAAU,EAAE,GAAG;gBACf,cAAc,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;gBACrC,eAAe,EAAE,0BAA0B,CAAC,OAAO,CAAC,CAAC,MAAM;aAC5D,CAAC,CAAC;YAEH,sEAAsE;YACtE,mEAAmE;YACnE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,EAAE;iBACZ,OAAO,CAAC,4DAA4D,CAAC;iBACrE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAyD,CAAC;YAC9E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM;oBAAE,SAAS;gBACtD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACvB,+DAA+D;oBAC/D,kEAAkE;oBAClE,4CAA4C;oBAC5C,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;oBACvE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,+DAA+D;oBAC/D,sDAAsD;oBACtD,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YAED,IAAI,CAAC;gBACH,gBAAgB,CAAC,EAAE,EAAE;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,EAAE,EAAE,cAAc;oBAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,6DAA6D;gBAC7D,6DAA6D;gBAC7D,iEAAiE;gBACjE,sCAAsC;YACxC,CAAC;YAED,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,qCAAqC;QACrC,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,uEAAuE;YACvE,iEAAiE;YACjE,iEAAiE;YACjE,yDAAyD;YACzD,8CAA8C;YAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;YACvG,IAAI,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3C,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAC,GAAG,CAChF,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,QAAgB,EAChB,cAAsB,EACtB,KAAa;IAEb,uEAAuE;IACvE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,QAAQ;IACR,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAE5E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,gBAAgB,CAAC,EAAE,EAAE;gBACnB,QAAQ;gBACR,KAAK;gBACL,EAAE,EAAE,gBAAgB;gBACpB,QAAQ,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBAC5C,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,QAAgB;IACzE,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/rejection.d.ts

@@ -0,0 +1,100 @@
+/**
+ * AT1 rejected-value tombstone — core invariant.
+ * docs/plans/2026-08-15-at1-rejected-value-tombstone.md
+ *
+ * Exact-normalized-value semantics: a human who rejects a fact can refuse
+ * byte-stable re-ingestion of the same value across remember/capture/import/
+ * sync surfaces. Paraphrase/semantic matching is explicitly out of scope
+ * (documented limitation, plan "Design").
+ *
+ * Kept db-agnostic (helpers take a `DatabaseSyncLike` handle) and does NOT
+ * import from store.ts — store.ts imports from here, and the reverse would
+ * be a cycle.
+ */
+import type { DatabaseSyncLike } from './db.js';
+/**
+ * Normalize content for rejection-digest comparisons: Unicode NFC →
+ * lowercase → collapse whitespace runs to a single space → trim. No
+ * punctuation stripping — over-normalization creates false refusals, which
+ * are worse than misses (plan §1).
+ */
+export declare function normalizeValueForRejection(content: string): string;
+/**
+ * Full sha256 hex (64 chars) of the normalized content. Reuses the strong-
+ * identity convention (importers.ts:814 content-hash tag), NOT the privacy-
+ * lossy 16-char convention (recall-trace query hashing) — a tombstone lookup
+ * key needs collision resistance, not redaction (plan §1).
+ */
+export declare function rejectionDigest(content: string): string;
+/**
+ * Thrown by the write-path guard (checkRejectionGuard, called from
+ * upsertEntryRow) when an incoming write would introduce a value matching a
+ * tombstoned digest. Carries enough context for the transaction-owner catch
+ * blocks (writeEntry, api.supersede) to write a post-rollback
+ * `reject_refusal` audit row via `auditRejectionRefusal` (plan §3).
+ */
+export declare class RejectedValueError extends Error {
+    readonly digest: string;
+    readonly tenantId: string;
+    readonly entryId: string;
+    readonly reason: string | null;
+    readonly rejectedAt: string;
+    constructor(opts: {
+        digest: string;
+        tenantId: string;
+        entryId: string;
+        reason: string | null;
+        rejectedAt: string;
+    });
+}
+export interface RejectedValueRow {
+    tenantId: string;
+    digest: string;
+    reason: string | null;
+    rejectedBy: string | null;
+    rejectedAt: string;
+    sourceMemoryId: string | null;
+    normalizedChars: number | null;
+}
+/**
+ * Look up a tombstone by tenant + digest. One indexed point query — the
+ * guard's common-case cost, a miss ends the guard (plan §3).
+ */
+export declare function findRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): RejectedValueRow | null;
+/**
+ * Insert (or refresh) a tombstone row. Caller owns the transaction — used by
+ * the T2 `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
+ */
+export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
+    tenantId: string;
+    digest: string;
+    reason: string;
+    rejectedBy: string;
+    rejectedAt: string;
+    sourceMemoryId?: string | null;
+    normalizedChars: number;
+}): void;
+/**
+ * Delete a tombstone by tenant + exact digest — the T2 `unreject` verb, the
+ * only v1 escape hatch (plan §4).
+ */
+export declare function deleteRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): boolean;
+/** List tombstones for a tenant, newest first — the T2 `rejections` verb. */
+export declare function listRejectedValues(db: DatabaseSyncLike, tenantId: string): RejectedValueRow[];
+/**
+ * The write-path guard's check helper, called from `upsertEntryRow`
+ * (store.ts). Fires when the incoming content's digest matches a tombstone
+ * AND the write *introduces* that content: the row is new, OR the stored
+ * row's content digest differs from the incoming one — an UPSERT editing a
+ * same-id row TO a rejected value is a content introduction and must be
+ * refused. Unchanged same-id re-persists (recall boost, decay, star toggle)
+ * are exempt by construction (plan §3).
+ *
+ * Ordering minimizes queries on the common (miss) path: (a) caller has
+ * already computed nothing yet — this does the digest + point lookup first;
+ * (b) a miss returns immediately (ONE indexed point query); (c) only on a
+ * tombstone hit does it SELECT the stored row's content to classify
+ * new-row vs content-introduction (+1 query, rare path).
+ */
+export declare function checkRejectionGuard(db: DatabaseSyncLike, tenantId: string, entryId: string, content: string): void;
+//# sourceMappingURL=rejection.d.ts.map

package/dist/rejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rejection.d.ts","sourceRoot":"","sources":["../src/rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,IAAI,EAAE;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB;CAYF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAwBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,gBAAgB,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,gBAAgB,GAAG,IAAI,CAQzB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,gBAAgB,EACpB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB,GACA,IAAI,CAmBN;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGnG;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAQ7F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,gBAAgB,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,IAAI,CAmCN"}