hippo-memory 1.45.0 → 1.46.0

package/dist/half-life-migration.js

@@ -0,0 +1,111 @@
+/**
+ * Moving a store's memories to a new default half-life.
+ *
+ * Each memory stores its own `half_life_days`, set at write from the
+ * default base and a few write-time multipliers (`deriveHalfLife`). Changing
+ * the default therefore reaches only new memories; without this migration a
+ * store would mix old-base and new-base memories, a state the decay
+ * evaluation never tested (docs/evals/2026-09-24-decay-default-prereg.md,
+ * Migration). The rule, declared there before any run:
+ *
+ * - only a memory still on the old base is rescaled: its half-life is
+ *   `deriveHalfLife(from, entry)` plus its recall bonus. A memory hippo shortened since
+ *   (invalidated, superseded, a merge source, marked bad) or one with its own
+ *   fixed half-life (decisions, incidents, customer notes) keeps its value;
+ * - every rescale is written to the audit log with the ids, so it can be
+ *   undone, and the store records the base it is on (`meta`), so the
+ *   migration runs once.
+ *
+ * `hippo sleep` runs it before its decay pass, from the base the store is on
+ * (7 days when never recorded) to the configured `defaultHalfLifeDays`.
+ */
+import { deriveHalfLife } from './memory.js';
+import { initStore, selectAllEntries, HALF_LIFE_BASE_META_KEY } from './store.js';
+import { openHippoDb, closeHippoDb, getMeta, setMeta } from './db.js';
+import { appendAuditEvent } from './audit.js';
+/** The base every store used before the base was recorded. */
+export const LEGACY_HALF_LIFE_BASE = 7;
+export { HALF_LIFE_BASE_META_KEY };
+/** Recall bonus over what `base` gave `entry`, or null when off that base; pre-1.46 recalls each added 2 days. */
+export function halfLifeRecallBonus(entry, base) {
+    if (entry.superseded_by || entry.tags.includes('invalidated') || entry.tags.includes('superseded'))
+        return null;
+    const bonus = entry.half_life_days - deriveHalfLife(base, entry);
+    const k = Math.round(bonus / 2);
+    return Math.abs(bonus - 2 * k) < 1e-9 && k >= 0 && k <= entry.retrieval_count ? bonus : null;
+}
+/** The entries to rescale from `from` to `to`, as copies that keep their recall bonus. Pure. */
+export function planHalfLifeMigration(entries, from, to) {
+    if (from === to)
+        return [];
+    return entries.flatMap((e) => {
+        const bonus = halfLifeRecallBonus(e, from);
+        return bonus === null ? [] : [{ ...e, half_life_days: deriveHalfLife(to, e) + bonus }];
+    });
+}
+/** The base this store's memories are on. */
+export function storeHalfLifeBase(hippoRoot) {
+    const db = openHippoDb(hippoRoot);
+    try {
+        return readBase(db);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function readBase(db) {
+    const raw = Number(getMeta(db, HALF_LIFE_BASE_META_KEY, String(LEGACY_HALF_LIFE_BASE)));
+    return Number.isFinite(raw) && raw > 0 ? raw : LEGACY_HALF_LIFE_BASE;
+}
+/**
+ * Move the store's memories from the base they are on to `to`. A no-op when
+ * they are already on it. Under `dryRun` nothing is written, the recorded
+ * base included.
+ */
+export function migrateDefaultHalfLife(hippoRoot, to, opts = {}) {
+    const dryRun = opts.dryRun ?? false;
+    const noop = (from) => ({ from, to, rescaled: 0, kept: 0, dryRun, halfLives: new Map() });
+    initStore(hippoRoot);
+    const db = openHippoDb(hippoRoot);
+    try {
+        // Plan, write, audit and record the base under one write lock, so a concurrent write or sleep cannot interleave.
+        if (!dryRun)
+            db.exec('BEGIN IMMEDIATE');
+        try {
+            const from = readBase(db);
+            if (!(Number.isFinite(to) && to > 0) || from === to) {
+                if (!dryRun)
+                    db.exec('COMMIT');
+                return noop(from);
+            }
+            const all = selectAllEntries(db);
+            const plan = planHalfLifeMigration(all, from, to);
+            const halfLives = new Map(plan.map((e) => [e.id, e.half_life_days]));
+            const result = { from, to, rescaled: plan.length, kept: all.length - plan.length, dryRun, halfLives };
+            if (dryRun)
+                return result;
+            const old = new Map(all.map((e) => [e.id, e.half_life_days]));
+            const update = db.prepare('UPDATE memories SET half_life_days = ? WHERE id = ?');
+            const byTenant = new Map();
+            for (const e of plan) {
+                update.run(e.half_life_days, e.id);
+                byTenant.set(e.tenantId, { ...byTenant.get(e.tenantId), [e.id]: old.get(e.id) });
+            }
+            for (const [tenantId, oldHalfLives] of byTenant) {
+                appendAuditEvent(db, { tenantId, actor: opts.actor ?? 'system', op: 'half_life_migrate', metadata: { from, to, ids: Object.keys(oldHalfLives), oldHalfLives } });
+            }
+            setMeta(db, HALF_LIFE_BASE_META_KEY, String(to));
+            db.exec('COMMIT');
+            return result;
+        }
+        catch (err) {
+            if (!dryRun)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=half-life-migration.js.map

package/dist/hooks.d.ts

@@ -85,6 +85,10 @@ export interface InstallResult {
     installedUserPromptSubmit: boolean;
     installedPreCompact: boolean;
     installedCompactResume: boolean;
+    /** PostCompact -> `hippo post-compact` (tells the user what compaction saved). */
+    installedPostCompact: boolean;
+    /** PostToolUseFailure -> `hippo capture-error` (failed tool calls become error memories). */
+    installedCaptureError: boolean;
     migratedPinnedInjectRecent: boolean;
     migratedFromStop: boolean;
     migratedLegacySessionEnd: boolean;

package/dist/hooks.js

@@ -52,6 +52,8 @@ const HIPPO_PINNED_INJECT_COMMAND = 'hippo context --pinned-only --include-recen
 const HIPPO_CODEX_WRAPPER_MARKER = 'hippo codex wrapper';
 const HIPPO_PRE_COMPACT_MARKER = 'hippo pre-compact';
 const HIPPO_COMPACT_RESUME_MARKER = 'hippo compact-resume';
+const HIPPO_CAPTURE_ERROR_MARKER = 'hippo capture-error';
+const HIPPO_POST_COMPACT_MARKER = 'hippo post-compact';
 const HIPPO_OPENCODE_PLUGIN_MARKER = 'HIPPO_OPENCODE_PLUGIN_V1';
 /**
  * The opencode plugin file we install at ~/.config/opencode/plugins/hippo.ts.
@@ -571,6 +573,8 @@ export function installJsonHooks(target) {
                 installedUserPromptSubmit: false,
                 installedPreCompact: false,
                 installedCompactResume: false,
+                installedPostCompact: false,
+                installedCaptureError: false,
                 migratedPinnedInjectRecent: false,
                 migratedFromStop: false,
                 migratedLegacySessionEnd: false,
@@ -703,11 +707,50 @@ export function installJsonHooks(target) {
         });
         installedCompactResume = true;
     }
+    // PostCompact: tells the user what pre-compact saved. PreCompact itself
+    // must stay silent, because Claude Code hands PreCompact stdout to the
+    // summarising model as instructions; PostCompact stdout is only shown.
+    let installedPostCompact = false;
+    if (!hookArrayContains(hooks.PostCompact, HIPPO_POST_COMPACT_MARKER)) {
+        if (!Array.isArray(hooks.PostCompact))
+            hooks.PostCompact = [];
+        hooks.PostCompact.push({
+            hooks: [
+                {
+                    type: 'command',
+                    command: `hippo post-compact --log-file "${defaultPreCompactLogPath()}"`,
+                    timeout: 10,
+                },
+            ],
+        });
+        installedPostCompact = true;
+    }
+    // PostToolUseFailure: a failed tool call becomes an error memory, after
+    // `hippo capture-error` drops routine failures (interrupts, declined
+    // permissions, empty searches) and repeats. Same hook the plugin ships.
+    let installedCaptureError = false;
+    if (!hookArrayContains(hooks.PostToolUseFailure, HIPPO_CAPTURE_ERROR_MARKER)) {
+        if (!Array.isArray(hooks.PostToolUseFailure))
+            hooks.PostToolUseFailure = [];
+        hooks.PostToolUseFailure.push({
+            matcher: '.*',
+            hooks: [
+                {
+                    type: 'command',
+                    command: 'hippo capture-error',
+                    timeout: 10,
+                },
+            ],
+        });
+        installedCaptureError = true;
+    }
     if (installedSessionEnd ||
         installedSessionStart ||
         installedUserPromptSubmit ||
         installedPreCompact ||
         installedCompactResume ||
+        installedPostCompact ||
+        installedCaptureError ||
         migratedPinnedInjectRecent ||
         migratedFromStop ||
         migratedLegacySessionEnd ||
@@ -722,6 +765,8 @@ export function installJsonHooks(target) {
         installedUserPromptSubmit,
         installedPreCompact,
         installedCompactResume,
+        installedPostCompact,
+        installedCaptureError,
         migratedPinnedInjectRecent,
         migratedFromStop,
         migratedLegacySessionEnd,
@@ -753,6 +798,8 @@ export function uninstallJsonHooks(target) {
         SessionStart: [HIPPO_LAST_SLEEP_MARKER, HIPPO_COMPACT_RESUME_MARKER],
         UserPromptSubmit: [HIPPO_PINNED_INJECT_MARKER],
         PreCompact: [HIPPO_PRE_COMPACT_MARKER],
+        PostCompact: [HIPPO_POST_COMPACT_MARKER],
+        PostToolUseFailure: [HIPPO_CAPTURE_ERROR_MARKER],
         Stop: [HIPPO_SLEEP_MARKER],
     };
     for (const [key, markers] of Object.entries(markersByKey)) {

package/dist/mcp/server.d.ts

@@ -42,6 +42,12 @@ export interface McpContext {
     hippoRoot: string;
     tenantId: string;
     actor: string;
+    /**
+     * The caller's role from the HTTP transport's auth. Absent for stdio, which
+     * is the local operator and runs as admin. Tools must use this rather than
+     * assuming admin, or a member key over HTTP-MCP would act as admin.
+     */
+    role?: 'admin' | 'member';
     /**
      * Per-client key for state isolation under HTTP-MCP. For stdio: 'stdio-${pid}'
      * (one process = one client). For HTTP-SSE / HTTP MCP: hash(bearer + remoteAddr)

package/dist/mcp/server.js

@@ -10,17 +10,18 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createMemory, Layer, calculateStrength, } from '../memory.js';
-import { hybridSearch, physicsSearch } from '../search.js';
+import { hybridSearch, physicsSearch, estimateTokens } from '../search.js';
 import { evalNow } from '../ablation.js';
 import { loadAllEntries, writeEntry, strengthenRetrieved, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, RECALL_DEFAULT_DENY_SCOPES, countCreatedSinceLastSleep } from '../store.js';
-import { shareMemory, listPeers, getGlobalRoot } from '../shared.js';
+import { shareMemory, listPeers, getGlobalRoot, initGlobal } from '../shared.js';
 import { consolidate } from '../consolidate.js';
 import { execSync } from 'child_process';
 import { fetchGitLog, extractLessons, partitionLessons, deduplicateLesson, isGitRepo } from '../autolearn.js';
 import { loadConfig } from '../config.js';
 import { confidenceLabel } from '../memory.js';
 import { resolveTenantId } from '../tenant.js';
-import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, isPrivateScope, passesScopeFilterForRecall, adminActor, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
+import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, isPrivateScope, passesScopeFilterForRecall, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
+import { assertScopeRequestAllowed } from '../recall-scope.js';
 import { resolveProjectIdentity, classifyOriginProject, findHippoStoreDir } from '../project-identity.js';
 import { computePredictionBaserate } from '../predictions.js';
 import { appendAuditEvent } from '../audit.js';
@@ -38,6 +39,7 @@ export function __resetSessionRecallHistoryMcp() {
 }
 import { applyGoalStackBoost } from '../goals.js';
 import { openHippoDb, closeHippoDb } from '../db.js';
+import { recordTokenUse } from '../token-ledger.js';
 import { PACKAGE_VERSION } from '../version.js';
 // ── Find hippo root ──
 /** Same bounded walk as the CLI (ends at home, so HIPPO_HOME wins over ~/.hippo); cwd/opts are the test seam. */
@@ -49,6 +51,14 @@ export function findHippoRoot(cwd = process.cwd(), opts) {
     const global = getGlobalRoot();
     return fs.existsSync(global) ? global : null;
 }
+/**
+ * The api-layer actor for a tool call. Stdio (no ctx) is the local operator
+ * and runs as admin; over HTTP the transport's authenticated role is used, so
+ * a member key never acts as admin through MCP.
+ */
+function mcpActor(ctx) {
+    return { subject: ctx?.actor ?? 'mcp', role: ctx?.role ?? 'admin' };
+}
 // MCP stdio transport spec: messages are newline-delimited JSON-RPC, no embedded newlines.
 // https://modelcontextprotocol.io/specification/.../basic/transports#stdio
 function send(msg) {
@@ -136,7 +146,7 @@ const TOOLS = [
             type: 'object',
             properties: {
                 query: { type: 'string', description: 'What to search for in memory (natural language)' },
-                budget: { type: 'number', description: 'Max tokens to return (default: 1500)' },
+                budget: { type: 'number', description: 'Max tokens to return (default: config.defaultBudget, 4000)' },
                 include_continuity: {
                     type: 'boolean',
                     description: 'Append continuity context (active snapshot + handoff + last 5 session events) below the memory results. Useful at session boot.',
@@ -265,7 +275,7 @@ const TOOLS = [
         inputSchema: {
             type: 'object',
             properties: {
-                budget: { type: 'number', minimum: 0, description: 'Max tokens (default: 1500)' },
+                budget: { type: 'number', minimum: 0, description: 'Max tokens (default: config.defaultContextBudget, 3000)' },
                 scope: {
                     type: 'string',
                     description: 'Restrict memories and snapshot to this scope exactly. When omitted, default-deny applies to ANY <source>:private:* (slack, github, ...) and unknown-legacy rows.',
@@ -367,6 +377,53 @@ function resolveClientKey(ctx) {
         return `stdio-${process.pid}:${ctx.tenantId}`;
     return `stdio-${process.pid}:default`;
 }
+/**
+ * Zero-install first run (`npx -y hippo-memory mcp` with no store anywhere):
+ * create the global store instead of failing every tool call, and say so on
+ * stderr (stdout carries the protocol). `hippo init` in a project later adds
+ * a project store, which then takes precedence.
+ */
+function createGlobalStoreOnFirstRun() {
+    initGlobal();
+    const root = getGlobalRoot();
+    console.error(`hippo: no memory store found; created the global store at ${root}. Run \`hippo init\` in a project for a project store.`);
+    return root;
+}
+// ── Token ledger (ROADMAP TE0) ──
+const MCP_TOKEN_SURFACES = new Map([
+    ['hippo_recall', 'mcp_recall'],
+    ['hippo_context', 'mcp_context'],
+]);
+/**
+ * Record the memory text a recall or context tool returned. Best-effort: a
+ * ledger failure never fails the tool call. Other tools are not recorded.
+ */
+function recordMcpTokens(toolName, output, ctx) {
+    const surface = MCP_TOKEN_SURFACES.get(toolName);
+    if (!surface || !output)
+        return;
+    try {
+        const hippoRoot = ctx?.hippoRoot ?? findHippoRoot();
+        if (!hippoRoot)
+            return;
+        const db = openHippoDb(hippoRoot);
+        try {
+            recordTokenUse(db, {
+                tenantId: ctx?.tenantId ?? resolveTenantId({}),
+                surface,
+                event: 'inject',
+                items: 0,
+                tokens: estimateTokens(output),
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+    }
+    catch {
+        // Ledger is best-effort.
+    }
+}
 // ── Tool execution ──
 async function executeTool(name, args, ctx) {
     // When a transport hands us a context (HTTP path), trust it: the HTTP
@@ -374,9 +431,7 @@ async function executeTool(name, args, ctx) {
     // from the Bearer token (or the loopback fallback). The stdio path
     // continues to walk from cwd / fall back to the global root, and to
     // resolve tenant from HIPPO_TENANT.
-    const hippoRoot = ctx?.hippoRoot ?? findHippoRoot();
-    if (!hippoRoot)
-        return 'No .hippo/ store found. Run: hippo init';
+    const hippoRoot = ctx?.hippoRoot ?? findHippoRoot() ?? createGlobalStoreOnFirstRun();
     const config = loadConfig(hippoRoot);
     // A5: every loadAllEntries() in this server returns to the caller and is
     // tenant-isolated. Resolved once per tool call: prefer the transport's
@@ -423,7 +478,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             // Route through api.recall for audit + (when requested) continuity block.
             // api.recall already applies the same default-deny / exact-match rules
@@ -771,7 +826,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const explicitScope = isJsonString(args.scope) && args.scope.length > 0
                 ? args.scope
@@ -815,7 +870,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const drillExtra = {};
             if (Number.isFinite(limit) && limit > 0)
@@ -890,7 +945,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const result = apiRemember(apiCtx, {
                 content: text,
@@ -926,7 +981,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const { applied } = apiOutcome(apiCtx, ids, good);
             return `Applied ${good ? 'positive' : 'negative'} outcome to ${applied} memories`;
@@ -957,6 +1012,7 @@ async function executeTool(name, args, ctx) {
             // results and the snapshot. Pre-v1.2 this surface returned all memories
             // and the snapshot unfiltered, which would have leaked private-channel
             // content to no-scope MCP callers once scope writers shipped.
+            assertScopeRequestAllowed(mcpActor(ctx).role, explicitScope);
             const allEntries = loadAllEntries(hippoRoot, tenantId);
             // v39 memory scope isolation: this surface reads the LOCAL store only,
             // but synced-down or legacy rows can still carry another project's
@@ -1184,6 +1240,7 @@ export async function handleMcpRequest(req, ctx) {
             const argumentsValue = params?.arguments;
             const toolArgs = isJsonObjectRecord(argumentsValue) ? argumentsValue : {};
             const output = await executeTool(toolName, toolArgs, ctx);
+            recordMcpTokens(toolName, output, ctx);
             return {
                 jsonrpc: '2.0',
                 id,

package/dist/memory.d.ts

@@ -141,6 +141,12 @@ export declare function _resetLossAversionRatioCacheForTests(): void;
  * decay slower; consistent negative outcomes decay faster.
  */
 export declare function calculateRewardFactor(entry: MemoryEntry): number;
+/**
+ * Net wrongness: bad outcome marks past good ones, never below zero.
+ * Strength halves per unit (capped at 3) and recall stops strengthening
+ * the memory, so a correction outranks pinning, error tags and heavy recall.
+ */
+export declare function netWrong(entry: MemoryEntry): number;
 /**
  * Options for decay basis.
  * - clock: wall-clock time (default pre-v0.15)
@@ -163,7 +169,7 @@ export interface DecayOptions {
  * - session: decay by sleep cycles instead of days (sessionsSince / halfLife)
  * - adaptive: wall-clock decay with half-life scaled by session frequency
  *
- * Pinned memories always return 1.0 (no decay).
+ * Pinned memories skip time decay; being marked wrong still fades them (netWrong).
  */
 export declare function calculateStrength(entry: MemoryEntry, now?: Date, options?: DecayOptions): number;
 /**
@@ -203,7 +209,15 @@ export declare function confidenceLabel(entry: MemoryEntry, now?: Date): {
  * returns 'stale'. Otherwise returns the stored confidence value.
  */
 export declare function resolveConfidence(entry: MemoryEntry, now?: Date): ConfidenceLevel;
-export declare const DEFAULT_HALF_LIFE_DAYS = 7;
+/**
+ * Base half-life for a new memory, in days, before `deriveHalfLife`'s
+ * write-time multipliers. 365 since 1.46.0: the pre-registered E1 decision
+ * (docs/evals/2026-09-24-decay-default-result.md and prereg-2) found 7 days
+ * lost the current fact far more often (29% vs 75% in the top five), and
+ * 730 days and decay off tied with 365. `hippo sleep` moves memories still
+ * on an older base (src/half-life-migration.ts).
+ */
+export declare const DEFAULT_HALF_LIFE_DAYS = 365;
 export declare const AUTO_DELETABLE_SQL = "pinned = 0 AND kind != 'raw'";
 export declare function canAutoDelete(entry: Pick<MemoryEntry, 'pinned' | 'kind'>): boolean;
 /**

package/dist/memory.js

@@ -143,6 +143,18 @@ export function calculateRewardFactor(entry) {
     const ratio = (pos - neg) / (pos + neg + 1);
     return 1 + 0.5 * ratio;
 }
+/** Bad marks alone never push a memory under sleep's 0.05 retire line; supersede is the hard correction. */
+const MAX_WRONG_HALVINGS = 3;
+/**
+ * Net wrongness: bad outcome marks past good ones, never below zero.
+ * Strength halves per unit (capped at 3) and recall stops strengthening
+ * the memory, so a correction outranks pinning, error tags and heavy recall.
+ */
+export function netWrong(entry) {
+    if (isOutcomeSlowAblated() || isDecayAblated())
+        return 0;
+    return Math.max(0, (entry.outcome_negative ?? 0) - (entry.outcome_positive ?? 0));
+}
 /**
  * Calculate current strength at a given time.
  * strength(t) = base_strength * decay * retrieval_boost * emotional_multiplier
@@ -152,14 +164,16 @@ export function calculateRewardFactor(entry) {
  * - session: decay by sleep cycles instead of days (sessionsSince / halfLife)
  * - adaptive: wall-clock decay with half-life scaled by session frequency
  *
- * Pinned memories always return 1.0 (no decay).
+ * Pinned memories skip time decay; being marked wrong still fades them (netWrong).
  */
 export function calculateStrength(entry, 
 // evalNow(): the real clock unless HIPPO_FAKE_NOW is set (eval-only,
 // simulated-time protocols; see ablation.ts). Explicit `now` always wins.
 now = evalNow(), options = {}) {
+    // Being marked wrong outranks every shield: pinning, error tags, heavy recall.
+    const wrongPenalty = Math.pow(0.5, Math.min(netWrong(entry), MAX_WRONG_HALVINGS));
     if (entry.pinned)
-        return 1.0;
+        return wrongPenalty;
     // EVAL-ONLY ablation (see ablation.ts): with recall-strengthening ablated,
     // anchor decay at CREATION, not last_retrieved. A never-strengthened memory
     // decays from when it was made; using last_retrieved would let clock resets
@@ -205,7 +219,7 @@ now = evalNow(), options = {}) {
     // the READ side too, so a store with PRIOR retrieval history (counts > 0
     // written before the flag was set) does not leak strengthening into an
     // ablated arm's rankings (codex P2).
-    const retrievalBoost = isRecallBoostAblated()
+    const retrievalBoost = isRecallBoostAblated() || netWrong(entry) > 0
         ? 1.0
         : 1 + 0.1 * Math.log2(entry.retrieval_count + 1);
     // Emotional multiplier
@@ -218,7 +232,7 @@ now = evalNow(), options = {}) {
     const raw = decay * retrievalBoost * emotionalMultiplier;
     // Clamp to [0, 1] with NaN guard
     const clamped = Math.min(1.0, Math.max(0.0, raw));
-    return Number.isFinite(clamped) ? clamped : 0.0;
+    return Number.isFinite(clamped) ? clamped * wrongPenalty : 0.0;
 }
 /**
  * Derive half-life based on signals, as per PLAN.md table.
@@ -296,7 +310,15 @@ export function confidenceLabel(entry, now = evalNow()) {
 export function resolveConfidence(entry, now = evalNow()) {
     return isAgedOut(entry, now) ? 'stale' : entry.confidence;
 }
-export const DEFAULT_HALF_LIFE_DAYS = 7;
+/**
+ * Base half-life for a new memory, in days, before `deriveHalfLife`'s
+ * write-time multipliers. 365 since 1.46.0: the pre-registered E1 decision
+ * (docs/evals/2026-09-24-decay-default-result.md and prereg-2) found 7 days
+ * lost the current fact far more often (29% vs 75% in the top five), and
+ * 730 days and decay off tied with 365. `hippo sleep` moves memories still
+ * on an older base (src/half-life-migration.ts).
+ */
+export const DEFAULT_HALF_LIFE_DAYS = 365;
 // Pinned means keep; raw rows leave only through archiveRawMemory. The SQL twin guards the DELETE itself.
 export const AUTO_DELETABLE_SQL = "pinned = 0 AND kind != 'raw'";
 export function canAutoDelete(entry) {

package/dist/physics-config.js

@@ -3,7 +3,11 @@
  * All constants are tunable; defaults calibrated for ~500 memory corpus.
  */
 export const DEFAULT_PHYSICS_CONFIG = {
-    enabled: 'auto',
+    // Off by default: the paired ablation (benchmarks/physics-ablation/) found
+    // physics worse than classic hybrid on every metric, CI excluding zero
+    // (MRR 0.68 vs 0.84, R@5 74% vs 84%). Opt in with physics.enabled 'auto'
+    // or true.
+    enabled: false,
     G_query: 2.0,
     G_memory: 0.01,
     K_repulsion: 0.5,

package/dist/recall-scope.d.ts

@@ -57,4 +57,28 @@ export declare function passesScopeFilterForRecall(scope: string | null, request
  * denied.
  */
 export declare function passesCliRecallScopeFilter(scope: string | null, requested: string | undefined): boolean;
+/**
+ * Thrown when a caller requests a scope its role may not read. The HTTP layer
+ * maps it to 403.
+ */
+export declare class ScopeForbiddenError extends Error {
+    readonly scope: string;
+    constructor(scope: string);
+}
+/**
+ * True for scopes that default-deny hides: `<source>:private:*` and the
+ * quarantine buckets. Naming one explicitly is what unlocks it, so naming one
+ * is the act that needs authorization.
+ */
+export declare function isRestrictedScope(scope: string | null | undefined): boolean;
+/**
+ * Authorize an explicitly requested scope before any read honours it.
+ *
+ * An admin (tenant owner, the local CLI, loopback without a key) may unlock
+ * any scope in its tenant. A member key may not unlock a restricted scope by
+ * naming it: before this check, any key in a tenant could read every private
+ * channel or repo by passing its scope string. Per-scope grants for member
+ * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
+ */
+export declare function assertScopeRequestAllowed(role: 'admin' | 'member', requested: string | undefined): void;
 //# sourceMappingURL=recall-scope.d.ts.map

package/dist/recall-scope.js

@@ -86,4 +86,45 @@ export function passesCliRecallScopeFilter(scope, requested) {
     }
     return passesScopeFilterForRecall(scope, undefined);
 }
+/**
+ * Thrown when a caller requests a scope its role may not read. The HTTP layer
+ * maps it to 403.
+ */
+export class ScopeForbiddenError extends Error {
+    scope;
+    constructor(scope) {
+        super(`scope ${scope} requires admin role`);
+        this.name = 'ScopeForbiddenError';
+        this.scope = scope;
+    }
+}
+/**
+ * True for scopes that default-deny hides: `<source>:private:*` and the
+ * quarantine buckets. Naming one explicitly is what unlocks it, so naming one
+ * is the act that needs authorization.
+ */
+export function isRestrictedScope(scope) {
+    if (!isScopeString(scope))
+        return false;
+    // SAFETY: RECALL_DEFAULT_DENY_SCOPES is a readonly tuple of string
+    // literals; widening the array (not the input) lets .includes() take any scope.
+    return isPrivateScope(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
+}
+/**
+ * Authorize an explicitly requested scope before any read honours it.
+ *
+ * An admin (tenant owner, the local CLI, loopback without a key) may unlock
+ * any scope in its tenant. A member key may not unlock a restricted scope by
+ * naming it: before this check, any key in a tenant could read every private
+ * channel or repo by passing its scope string. Per-scope grants for member
+ * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
+ */
+export function assertScopeRequestAllowed(role, requested) {
+    if (requested === undefined || requested === '')
+        return;
+    if (role === 'admin')
+        return;
+    if (isRestrictedScope(requested))
+        throw new ScopeForbiddenError(requested);
+}
 //# sourceMappingURL=recall-scope.js.map

package/dist/reject-flow.d.ts

@@ -7,9 +7,9 @@
  * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
  * here (leaf module) so neither duplicates it.
  *
- * Module direction: this file imports from store.ts, rejection.ts, and
- * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
- * so it introduces no cycle.
+ * Module direction: this file imports from store.ts, rejection.ts,
+ * raw-archive.ts and dormant.ts. Nothing imports FROM this file except
+ * cli.ts and api.ts, so it introduces no cycle.
  */
 import { type RejectedValueRow } from './rejection.js';
 export interface RejectFlowOpts {

package/dist/reject-flow.js

@@ -7,13 +7,14 @@
  * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
  * here (leaf module) so neither duplicates it.
  *
- * Module direction: this file imports from store.ts, rejection.ts, and
- * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
- * so it introduces no cycle.
+ * Module direction: this file imports from store.ts, rejection.ts,
+ * raw-archive.ts and dormant.ts. Nothing imports FROM this file except
+ * cli.ts and api.ts, so it introduces no cycle.
  */
 import { openHippoDb, closeHippoDb } from './db.js';
 import { appendAuditEvent } from './audit.js';
 import { archiveRawMemory } from './raw-archive.js';
+import { purgeDormantByDigest } from './dormant.js';
 import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
 import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
 /**
@@ -102,6 +103,12 @@ export function rejectValue(opts) {
                 }
                 removedIds.push(row.id);
             }
+            // Dormant copies (src/dormant.ts) go too, in the same transaction: a
+            // rejected value may not linger where `hippo dormant restore` could
+            // bring it back. They have no markdown mirror, so the post-commit
+            // mirror purge below is a no-op for them; they join removedIds for the
+            // audit trail and the caller's report.
+            removedIds.push(...purgeDormantByDigest(db, opts.tenantId, digest));
             try {
                 appendAuditEvent(db, {
                     tenantId: opts.tenantId,