hippo-memory 1.49.0 → 1.51.0

package/dist/config.js

@@ -73,6 +73,9 @@ const DEFAULT_CONFIG = {
         enabled: true,
         retentionDays: 180,
     },
+    churnStaleness: {
+        enabled: false,
+    },
 };
 function isMemoryValueConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -80,6 +83,9 @@ function isMemoryValueConfig(value) {
 function isDormantConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function isChurnStalenessConfig(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 export function loadConfig(hippoRoot) {
     const configPath = path.join(hippoRoot, 'config.json');
     if (!fs.existsSync(configPath))
@@ -124,6 +130,21 @@ export function loadConfig(hippoRoot) {
                 `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
             dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
         }
+        // Same "never silently wrong" rule as memoryValue/dormant above.
+        const churnStalenessRaw = raw.churnStaleness;
+        const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
+        if (!validChurnStalenessConfig) {
+            console.error(`Warning: config.json's "churnStaleness" must be an object like {"enabled": true} ` +
+                `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
+        }
+        let churnStalenessEnabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
+            ? churnStalenessRaw.enabled
+            : DEFAULT_CONFIG.churnStaleness.enabled;
+        if (churnStalenessEnabled !== true && churnStalenessEnabled !== false) {
+            console.error(`Warning: config.json's "churnStaleness.enabled" must be true or false ` +
+                `(got ${JSON.stringify(churnStalenessEnabled)}) - using false.`);
+            churnStalenessEnabled = false;
+        }
         return {
             defaultHalfLifeDays: raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays,
             defaultBudget: raw.defaultBudget ?? DEFAULT_CONFIG.defaultBudget,
@@ -155,6 +176,9 @@ export function loadConfig(hippoRoot) {
                 enabled: dormantEnabled,
                 retentionDays: dormantRetentionDays,
             },
+            churnStaleness: {
+                enabled: churnStalenessEnabled,
+            },
         };
     }
     catch (err) {

package/dist/connectors/github/ingest.js

@@ -108,6 +108,7 @@ export function ingestEvent(ctx, input) {
         // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
         const result = remember(ctx, {
             ...opts,
+            untrusted: true,
             afterWrite: (innerDb, memoryId) => {
                 if (input.__testInjectBeforeLog) {
                     input.__testInjectBeforeLog(innerDb, idempotencyKey);

package/dist/connectors/slack/ingest.js

@@ -61,6 +61,7 @@ export function ingestMessage(ctx, input) {
         // ever missing); explicit reliance on the caller is safer.
         const result = remember(ctx, {
             ...opts,
+            untrusted: true,
             afterWrite: (innerDb, memoryId) => {
                 const inserted = innerDb
                     .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)

package/dist/consolidate.js

@@ -26,6 +26,7 @@ import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-wei
 import { appendAuditEvent } from './audit.js';
 import { migrateDefaultHalfLife } from './half-life-migration.js';
 import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
+import { isQuarantineScope } from './quarantine.js';
 const DECAY_THRESHOLD = 0.05;
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
@@ -945,6 +946,8 @@ function detectConflicts(entries, now, decayOpts = {},
 // Default empty set: flag-off behavior is unchanged.
 rescuedIds = new Set()) {
     const survivors = entries.filter((entry) => entry.layer !== Layer.Semantic
+        // CD5: an unreviewed quarantined row must not taint a visible memory as conflicted.
+        && !isQuarantineScope(entry.scope ?? null)
         && (rescuedIds.has(entry.id) || calculateStrength(entry, now, decayOpts) >= DECAY_THRESHOLD));
     const detected = [];
     for (let i = 0; i < survivors.length; i++) {

package/dist/db.js

@@ -11,7 +11,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 47;
+const CURRENT_SCHEMA_VERSION = 48;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2463,6 +2463,14 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 48,
+        up: (db) => {
+            // Quarantine (src/quarantine.ts, CD5): a poisoned or suspect memory sits here pending
+            // admin review instead of being hidden with no record. Additive only: no min_compatible_binary bump.
+            db.exec(MEMORY_QUARANTINE_DDL);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))
@@ -2628,6 +2636,22 @@ function setSchemaVersion(db, version) {
     db.prepare(`INSERT INTO meta(key, value) VALUES('schema_version', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run(String(version));
     db.exec(`PRAGMA user_version = ${Math.max(0, Math.trunc(version))}`);
 }
+// Shared by migration v48 and the stamped-store self-heal below.
+const MEMORY_QUARANTINE_DDL = `
+    CREATE TABLE IF NOT EXISTS memory_quarantine (
+      tenant_id      TEXT NOT NULL DEFAULT 'default',
+      memory_id      TEXT NOT NULL,
+      original_scope TEXT,
+      reason         TEXT NOT NULL,
+      status         TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected')),
+      quarantined_at TEXT NOT NULL,
+      decided_at     TEXT,
+      decided_by     TEXT,
+      PRIMARY KEY (tenant_id, memory_id)
+    ) WITHOUT ROWID;
+    CREATE INDEX IF NOT EXISTS idx_memory_quarantine_status
+      ON memory_quarantine(tenant_id, status, quarantined_at DESC);
+`;
 // Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
 // incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
 function ensureContinuityTables(db) {
@@ -2729,6 +2753,7 @@ function ensureContinuityTables(db) {
       tenant_id TEXT NOT NULL DEFAULT 'default'
     )
   `);
+    db.exec(MEMORY_QUARANTINE_DDL);
 }
 // After the loop: tenant_id (v16) and scope (v23) do not exist yet on a genuine old store.
 function ensureContinuityIndexes(db) {

package/dist/instruction-detect.d.ts

@@ -0,0 +1,7 @@
+/** Prompt-injection detection for untrusted memory content (CD5). Same shape as secret-detect.ts; leaf module, no store/api/shared imports. */
+export interface InstructionDetection {
+    flagged: boolean;
+    reason: string | null;
+}
+export declare function detectInstruction(content: string): InstructionDetection;
+//# sourceMappingURL=instruction-detect.d.ts.map

package/dist/instruction-detect.js

@@ -0,0 +1,27 @@
+/** Prompt-injection detection for untrusted memory content (CD5). Same shape as secret-detect.ts; leaf module, no store/api/shared imports. */
+const INSTRUCTION_PATTERNS = [
+    { name: 'override-instructions', re: /\b(?:ignore|disregard|forget)\b[^.\n]{0,40}\b(?:previous|prior|above)\b[^.\n]{0,40}\binstructions?\b/i },
+    { name: 'role-reassignment', re: /\b(?:you are now|act as|pretend to be)\b[^.\n]{0,40}\b(?:an?\s+)?(?:ai|assistant|agent|system)\b/i },
+    { name: 'chat-role-markup', re: /<\|im_start\|>|<\|system\|>|\[INST\]|<\/?system>|###\s*system\s*:/i },
+    { name: 'system-prompt-reference', re: /\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b/i },
+    // "always"/"never" alone (ordinary PR prose) doesn't flag without an agent-facing target nearby too.
+    { name: 'standing-order', re: /\b(?:from now on|whenever you|always|never)\b[^.\n]{0,50}\b(?:you must|(?:the ai|the assistant|the agent|claude|copilot)\s+(?:must|should|will)\b)/i },
+    { name: 'concealment', re: /\b(?:do not|never|don't)\b[^.\n]{0,40}\b(?:tell|mention|reveal)\b[^.\n]{0,40}\bthe user\b/i },
+    { name: 'remote-script-exec', re: /\b(?:curl|wget)\b[^\n|]{0,80}\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b|\biex\s*\(\s*(?:iwr|invoke-webrequest|new-object\s+net\.webclient)/i },
+    { name: 'exfiltration', re: /\b(?:send|post|upload|exfiltrate)\b[^.\n]{0,40}\b(?:secrets?|tokens?|api[- ]?keys?|credentials?|env(?:ironment)? variables?)\b/i },
+    { name: 'unicode-tag-chars', re: /[\u{E0000}-\u{E007F}]/u },
+];
+// A stray zero-width char has legitimate uses (ZWJ); only a run of 3+ adjacent ones reads as smuggling.
+const ZERO_WIDTH_RUN_RE = /[\u200B-\u200F\u2060-\u2064]{3,}/;
+export function detectInstruction(content) {
+    for (const { name, re } of INSTRUCTION_PATTERNS) {
+        if (re.test(content)) {
+            return { flagged: true, reason: `pattern:${name}` };
+        }
+    }
+    if (ZERO_WIDTH_RUN_RE.test(content)) {
+        return { flagged: true, reason: 'pattern:zero-width-smuggling' };
+    }
+    return { flagged: false, reason: null };
+}
+//# sourceMappingURL=instruction-detect.js.map

package/dist/invalidation.d.ts

@@ -38,4 +38,34 @@ export declare function extractInvalidationTarget(message: string): Invalidation
  * auto-learn-from-git path) inherit this contract.
  */
 export declare function invalidateMatching(hippoRoot: string, target: InvalidationTarget, tenantId?: string, options?: InvalidationOptions): InvalidationResult;
+export interface ChurnRefs {
+    paths: string[];
+    symbols: string[];
+    scripts: string[];
+}
+/** Pure syntactic extraction; repo-aware resolution (trackedness, path relativization) happens only in detectChurnStale. */
+export declare function extractChurnRefs(content: string): ChurnRefs;
+export interface DetectChurnStaleOptions {
+    tenantId: string;
+    projectName: string;
+    /** Evaluate matches but write nothing. */
+    dryRun?: boolean;
+}
+export interface ChurnStalePreviewRow {
+    id: string;
+    headline: string;
+    evidence: string;
+    already: boolean;
+}
+export interface ChurnStaleResult {
+    checked: number;
+    marked: number;
+    alreadyMarked: number;
+    skippedPinned: string[];
+    dryRun: boolean;
+    preview: ChurnStalePreviewRow[];
+    error?: string;
+}
+/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
+export declare function detectChurnStale(hippoRoot: string, repoRoot: string, opts: DetectChurnStaleOptions): ChurnStaleResult;
 //# sourceMappingURL=invalidation.d.ts.map

package/dist/invalidation.js

@@ -1,4 +1,7 @@
-import { loadAllEntries, writeEntry } from './store.js';
+import { loadAllEntries, readEntry, writeEntry } from './store.js';
+import { openHippoDb, closeHippoDb } from './db.js';
+import { CHURN_STALE_TAG } from './memory.js';
+import { GitReadError, gitLsFilesAtHead, fetchChurnWindowLog, gitGrepPresence, resolveCommitBefore, packageScriptsAt, } from './churn-git.js';
 /**
  * Extract what was replaced/removed from a commit message.
  * Returns null if the commit isn't a breaking/migration change.
@@ -126,4 +129,266 @@ function matchScore(fromTokens, contentTokens) {
     const matches = fromTokens.filter(t => contentSet.has(t)).length;
     return matches / fromTokens.length;
 }
+// FE2: staleness from code churn (opt-in, ROADMAP Part XIII).
+const CHURN_PATH_EXTENSIONS = [
+    'ts', 'tsx', 'js', 'mjs', 'cjs', 'py', 'md', 'json', 'sh', 'ps1',
+    'toml', 'yml', 'yaml', 'sql', 'rs', 'go', 'css', 'html',
+];
+const CHURN_PATH_RE = new RegExp(
+// The lookahead stops `ts` winning over `tsx` and `js` over `json`.
+`[A-Za-z0-9_./\\\\:-]+\\.(?:${CHURN_PATH_EXTENSIONS.join('|')})(?![A-Za-z0-9_])(?::\\d+(?:-\\d+)?)?`, 'g');
+const CHURN_SYMBOL_RE = /`([A-Za-z_$][A-Za-z0-9_$]*)(?:\(\))?`/g;
+const CHURN_SCRIPT_RE = /npm run(?:-script)?\s+([A-Za-z0-9:_-]+)/g;
+/** Pure syntactic extraction; repo-aware resolution (trackedness, path relativization) happens only in detectChurnStale. */
+export function extractChurnRefs(content) {
+    const paths = new Set();
+    for (const m of content.matchAll(CHURN_PATH_RE)) {
+        let token = m[0].replace(/:\d+(?:-\d+)?$/, '');
+        token = token.replace(/\\/g, '/').replace(/^\.\//, '');
+        if (token)
+            paths.add(token);
+    }
+    const symbols = new Set();
+    for (const m of content.matchAll(CHURN_SYMBOL_RE)) {
+        const name = m[1];
+        // Plain words never count: require a camelCase/PascalCase transition or an inner underscore.
+        if (name.length >= 6 && (/[a-z][A-Z]/.test(name) || /[A-Za-z0-9]_[A-Za-z0-9]/.test(name))) {
+            symbols.add(name);
+        }
+    }
+    const scripts = new Set();
+    for (const m of content.matchAll(CHURN_SCRIPT_RE))
+        scripts.add(m[1]);
+    return { paths: [...paths], symbols: [...symbols], scripts: [...scripts] };
+}
+const IS_WIN32 = process.platform === 'win32';
+function buildTrackedIndex(paths) {
+    const lower = new Map();
+    for (const p of paths)
+        lower.set(p.toLowerCase(), p);
+    return { exact: paths, lower };
+}
+// Returns git's spelling so later exact matches against the log agree on case-insensitive Windows.
+function trackedSpelling(index, candidate) {
+    if (index.exact.has(candidate))
+        return candidate;
+    return IS_WIN32 ? index.lower.get(candidate.toLowerCase()) ?? null : null;
+}
+function isTrackedPath(index, candidate) {
+    return trackedSpelling(index, candidate) !== null;
+}
+// Absolute-path relativization and the <repoName>/ strip both need the repo, so they
+// happen here rather than in the pure extractor.
+function resolveTrackedPath(token, repoRoot, projectName, index) {
+    let candidate = token;
+    const isAbsUnix = candidate.startsWith('/');
+    const isAbsWin = /^[A-Za-z]:\//.test(candidate);
+    if (isAbsUnix || isAbsWin) {
+        const rootPosix = repoRoot.replace(/\\/g, '/').replace(/\/$/, '');
+        const prefix = `${rootPosix}/`;
+        const under = IS_WIN32
+            ? candidate.toLowerCase().startsWith(prefix.toLowerCase())
+            : candidate.startsWith(prefix);
+        if (!under)
+            return null;
+        candidate = candidate.slice(prefix.length);
+    }
+    const direct = trackedSpelling(index, candidate);
+    if (direct)
+        return direct;
+    const repoPrefix = `${projectName}/`;
+    if (candidate.toLowerCase().startsWith(repoPrefix.toLowerCase())) {
+        return trackedSpelling(index, candidate.slice(repoPrefix.length));
+    }
+    return null;
+}
+// Anchor SQL runs on its own handle (closed in finally); queryAuditEvents is NOT
+// reused here because its 10k-row cap would silently miss old confirmations.
+function queryConfirmedAt(hippoRoot, tenantId) {
+    const db = openHippoDb(hippoRoot);
+    try {
+        // SAFETY: the SELECT list above is exactly target_id and ts; no other shape reaches this cast.
+        const rows = db.prepare(`SELECT target_id, MAX(ts) AS ts FROM audit_log
+       WHERE tenant_id = ? AND op = 'outcome' AND target_id IS NOT NULL
+         AND json_extract(metadata_json, '$.good') = 1
+       GROUP BY target_id`).all(tenantId);
+        return new Map(rows.map((r) => [r.target_id, r.ts]));
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function emptyChurnResult(dryRun, skippedPinned = [], error) {
+    const result = { checked: 0, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
+    if (error !== undefined)
+        result.error = error;
+    return result;
+}
+/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
+export function detectChurnStale(hippoRoot, repoRoot, opts) {
+    const dryRun = opts.dryRun === true;
+    if (!opts.projectName)
+        return emptyChurnResult(dryRun);
+    const entries = loadAllEntries(hippoRoot, opts.tenantId);
+    const skippedPinned = [];
+    const candidates = [];
+    for (const entry of entries) {
+        if (!entry.origin_project || entry.origin_project !== opts.projectName)
+            continue;
+        if (entry.superseded_by)
+            continue;
+        if (entry.kind === 'raw' || entry.kind === 'archived')
+            continue;
+        if (entry.pinned) {
+            skippedPinned.push(entry.id);
+            continue;
+        }
+        // An unparsable created has no anchor to compare commits against.
+        if (Number.isNaN(Date.parse(entry.created)))
+            continue;
+        candidates.push({ entry, refs: extractChurnRefs(entry.content) });
+    }
+    if (candidates.length === 0)
+        return emptyChurnResult(dryRun, skippedPinned);
+    const confirmedAt = queryConfirmedAt(hippoRoot, opts.tenantId);
+    // Compared as epoch ms, not strings: imported rows may carry offsets or other ISO forms.
+    const anchorOf = (entry) => {
+        const confirmed = confirmedAt.get(entry.id);
+        const confirmedMs = confirmed ? Date.parse(confirmed) : NaN;
+        return confirmedMs > Date.parse(entry.created) ? new Date(confirmedMs).toISOString() : new Date(entry.created).toISOString();
+    };
+    const needsPaths = candidates.some((c) => c.refs.paths.length > 0);
+    const needsSymbols = candidates.some((c) => c.refs.symbols.length > 0);
+    const needsScripts = candidates.some((c) => c.refs.scripts.length > 0);
+    if (!needsPaths && !needsSymbols && !needsScripts) {
+        return { checked: candidates.length, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
+    }
+    const result = { checked: 0, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
+    try {
+        const headFiles = gitLsFilesAtHead(repoRoot);
+        let windowLog = [];
+        if (needsPaths) {
+            const minAnchor = candidates.reduce((min, c) => {
+                const a = anchorOf(c.entry);
+                return min === '' || a < min ? a : min;
+            }, '');
+            windowLog = fetchChurnWindowLog(repoRoot, minAnchor);
+        }
+        const touchedInWindow = new Set();
+        for (const c of windowLog)
+            for (const f of c.files)
+                touchedInWindow.add(f.path);
+        const trackedIndex = buildTrackedIndex(new Set([...headFiles, ...touchedInWindow]));
+        const headIndex = buildTrackedIndex(headFiles);
+        const presentAtHeadSymbols = needsSymbols
+            ? gitGrepPresence(repoRoot, [...new Set(candidates.flatMap((c) => c.refs.symbols))], 'HEAD')
+            : new Set();
+        const anchorCommitCache = new Map();
+        const resolveAnchorCommit = (anchorIso) => {
+            if (!anchorCommitCache.has(anchorIso)) {
+                anchorCommitCache.set(anchorIso, resolveCommitBefore(repoRoot, anchorIso));
+            }
+            return anchorCommitCache.get(anchorIso) ?? null;
+        };
+        const symbolsAtCommit = new Map();
+        const symbolsPresentAt = (hash, symbols) => {
+            const known = symbolsAtCommit.get(hash) ?? new Set();
+            const missing = symbols.filter((s) => !known.has(s));
+            if (missing.length > 0) {
+                for (const s of gitGrepPresence(repoRoot, missing, hash))
+                    known.add(s);
+                symbolsAtCommit.set(hash, known);
+            }
+            return known;
+        };
+        const headScripts = needsScripts ? packageScriptsAt(repoRoot, 'HEAD') : null;
+        const scriptsAtCommit = new Map();
+        // Collected here, written only after every candidate's evidence is
+        // computed: a GitReadError thrown mid-loop must never leave an earlier
+        // candidate tagged while a later one aborts the run untagged.
+        const toTag = [];
+        for (const { entry, refs } of candidates) {
+            result.checked++;
+            const anchor = anchorOf(entry);
+            const anchorTime = new Date(anchor).getTime();
+            let evidence = null;
+            for (const rawPath of refs.paths) {
+                const resolved = resolveTrackedPath(rawPath, repoRoot, opts.projectName, trackedIndex);
+                if (!resolved)
+                    continue;
+                if (isTrackedPath(headIndex, resolved)) {
+                    const changed = windowLog.some((c) => new Date(c.date).getTime() > anchorTime && c.files.some((f) => f.path === resolved));
+                    if (changed) {
+                        evidence = `file-changed: ${resolved}`;
+                        break;
+                    }
+                }
+                else {
+                    // --no-renames means a rename shows as a D + A pair, so this also fires for renames.
+                    const deleted = windowLog.some((c) => new Date(c.date).getTime() > anchorTime &&
+                        c.files.some((f) => f.status === 'D' && f.path === resolved));
+                    if (deleted) {
+                        evidence = `file-deleted: ${resolved}`;
+                        break;
+                    }
+                }
+            }
+            if (!evidence && refs.symbols.length > 0) {
+                const absent = refs.symbols.filter((s) => !presentAtHeadSymbols.has(s));
+                if (absent.length > 0) {
+                    const anchorCommit = resolveAnchorCommit(anchor);
+                    if (anchorCommit) {
+                        const presentAtAnchor = symbolsPresentAt(anchorCommit, absent);
+                        const hit = absent.find((s) => presentAtAnchor.has(s));
+                        if (hit)
+                            evidence = `symbol-gone: \`${hit}\``;
+                    }
+                }
+            }
+            if (!evidence && refs.scripts.length > 0 && headScripts !== null) {
+                const anchorCommit = resolveAnchorCommit(anchor);
+                if (anchorCommit) {
+                    if (!scriptsAtCommit.has(anchorCommit)) {
+                        scriptsAtCommit.set(anchorCommit, packageScriptsAt(repoRoot, anchorCommit));
+                    }
+                    const anchorScripts = scriptsAtCommit.get(anchorCommit);
+                    const hit = anchorScripts
+                        ? refs.scripts.find((s) => anchorScripts[s] !== undefined && headScripts[s] === undefined)
+                        : undefined;
+                    if (hit)
+                        evidence = `script-gone: ${hit}`;
+                }
+            }
+            if (!evidence)
+                continue;
+            const headline = entry.content.replace(/\s+/g, ' ').slice(0, 60);
+            if (entry.tags.includes(CHURN_STALE_TAG)) {
+                result.alreadyMarked++;
+                result.preview.push({ id: entry.id, headline, evidence, already: true });
+                continue;
+            }
+            result.marked++;
+            result.preview.push({ id: entry.id, headline, evidence, already: false });
+            toTag.push(entry);
+        }
+        if (!dryRun && toTag.length > 0) {
+            // The git calls above can take seconds; a good outcome landing meanwhile moves the anchor past the evidence.
+            const confirmedNow = queryConfirmedAt(hippoRoot, opts.tenantId);
+            for (const stale of toTag) {
+                if (confirmedNow.get(stale.id) !== confirmedAt.get(stale.id))
+                    continue;
+                const entry = readEntry(hippoRoot, stale.id, opts.tenantId);
+                if (!entry || entry.tags.includes(CHURN_STALE_TAG))
+                    continue;
+                writeEntry(hippoRoot, { ...entry, tags: [...entry.tags, CHURN_STALE_TAG] });
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof GitReadError)
+            return emptyChurnResult(dryRun, skippedPinned, err.message);
+        throw err;
+    }
+    return result;
+}
 //# sourceMappingURL=invalidation.js.map

package/dist/memory.d.ts

@@ -120,6 +120,8 @@ export declare const POLICY_HALF_LIFE_DAYS = 90;
 export declare const SKILL_HALF_LIFE_DAYS = 90;
 export declare const PROJECT_BRIEF_HALF_LIFE_DAYS = 90;
 export declare const CUSTOMER_NOTE_HALF_LIFE_DAYS = 90;
+/** FE2: tag on a memory whose named file/symbol/script changed after it was stored. */
+export declare const CHURN_STALE_TAG = "churn-stale";
 /**
  * Test-only helper. Tests that mutate `process.env.HIPPO_LOSS_AVERSION_RATIO`
  * MUST call this in BOTH `beforeEach` AND `afterEach`:

package/dist/memory.js

@@ -18,6 +18,8 @@ export const POLICY_HALF_LIFE_DAYS = 90;
 export const SKILL_HALF_LIFE_DAYS = 90;
 export const PROJECT_BRIEF_HALF_LIFE_DAYS = 90;
 export const CUSTOMER_NOTE_HALF_LIFE_DAYS = 90;
+/** FE2: tag on a memory whose named file/symbol/script changed after it was stored. */
+export const CHURN_STALE_TAG = 'churn-stale';
 // Emotional multipliers from PLAN.md.
 //
 // v1.13.5 / J5 loss-aversion calibration (Lovallo-Kahneman TFAS empirics:

package/dist/quarantine.d.ts

@@ -0,0 +1,31 @@
+/** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
+import type { DatabaseSyncLike } from './db.js';
+export declare const QUARANTINE_SCOPE_PREFIX = "quarantine:private:";
+/** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
+export declare function quarantineScopeFor(original: string | null): string;
+export declare function isQuarantineScope(scope: string | null | undefined): boolean;
+export type QuarantineStatus = 'pending' | 'approved' | 'rejected';
+export interface QuarantineRow {
+    tenantId: string;
+    memoryId: string;
+    originalScope: string | null;
+    reason: string;
+    status: QuarantineStatus;
+    quarantinedAt: string;
+    decidedAt: string | null;
+    decidedBy: string | null;
+}
+export interface RecordQuarantineOpts {
+    tenantId: string;
+    memoryId: string;
+    originalScope: string | null;
+    reason: string;
+    actor: string;
+}
+/** Insert the quarantine row + its audit event; caller runs this inside the memory's own write transaction. */
+export declare function recordQuarantine(db: DatabaseSyncLike, opts: RecordQuarantineOpts): void;
+export declare function getQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string): QuarantineRow | null;
+export declare function listQuarantineRows(db: DatabaseSyncLike, tenantId: string, status?: QuarantineStatus | 'all', limit?: number): QuarantineRow[];
+export declare function approveQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string, decidedBy: string): void;
+export declare function rejectQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string, decidedBy: string): void;
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/quarantine.js

@@ -0,0 +1,63 @@
+/** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
+import { appendAuditEvent } from './audit.js';
+export const QUARANTINE_SCOPE_PREFIX = 'quarantine:private:';
+/** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
+export function quarantineScopeFor(original) {
+    return `${QUARANTINE_SCOPE_PREFIX}${original ?? 'unscoped'}`;
+}
+export function isQuarantineScope(scope) {
+    return scope != null && scope.startsWith(QUARANTINE_SCOPE_PREFIX);
+}
+const SELECT_COLUMNS = 'tenant_id, memory_id, original_scope, reason, status, quarantined_at, decided_at, decided_by';
+function fromDbRow(row) {
+    return {
+        tenantId: row.tenant_id,
+        memoryId: row.memory_id,
+        originalScope: row.original_scope,
+        reason: row.reason,
+        // SAFETY: this module's own INSERT/UPDATE statements are the only writers of status.
+        status: row.status,
+        quarantinedAt: row.quarantined_at,
+        decidedAt: row.decided_at,
+        decidedBy: row.decided_by,
+    };
+}
+/** Insert the quarantine row + its audit event; caller runs this inside the memory's own write transaction. */
+export function recordQuarantine(db, opts) {
+    db.prepare(`INSERT INTO memory_quarantine (tenant_id, memory_id, original_scope, reason, status, quarantined_at)
+     VALUES (?, ?, ?, ?, 'pending', ?)`).run(opts.tenantId, opts.memoryId, opts.originalScope, opts.reason, new Date().toISOString());
+    appendAuditEvent(db, {
+        tenantId: opts.tenantId,
+        actor: opts.actor,
+        op: 'quarantine',
+        targetId: opts.memoryId,
+        metadata: { reason: opts.reason, originalScope: opts.originalScope },
+    });
+}
+export function getQuarantineRow(db, tenantId, memoryId) {
+    const row = db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND memory_id = ?`)
+        .get(tenantId, memoryId);
+    return row ? fromDbRow(row) : null;
+}
+export function listQuarantineRows(db, tenantId, status = 'pending', limit = 100) {
+    // A pending row whose memory was deleted (e.g. Slack message_deleted) is dead; keep its history, drop it from the queue.
+    const live = status === 'pending'
+        ? ' AND EXISTS (SELECT 1 FROM memories m WHERE m.id = memory_quarantine.memory_id AND m.tenant_id = memory_quarantine.tenant_id)'
+        : '';
+    const rows = status === 'all'
+        ? db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? ORDER BY quarantined_at DESC LIMIT ?`)
+            .all(tenantId, limit)
+        : db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND status = ?${live} ORDER BY quarantined_at DESC LIMIT ?`)
+            .all(tenantId, status, limit);
+    // SAFETY: both branches select SELECT_COLUMNS, matching QuarantineDbRow's field set.
+    return rows.map(fromDbRow);
+}
+export function approveQuarantineRow(db, tenantId, memoryId, decidedBy) {
+    db.prepare(`UPDATE memory_quarantine SET status = 'approved', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
+        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+}
+export function rejectQuarantineRow(db, tenantId, memoryId, decidedBy) {
+    db.prepare(`UPDATE memory_quarantine SET status = 'rejected', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
+        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+}
+//# sourceMappingURL=quarantine.js.map

package/dist/search.d.ts

@@ -5,6 +5,8 @@
 import { estimateTokens } from './token-ledger.js';
 import { MemoryEntry } from './memory.js';
 import type { PhysicsConfig } from './physics-config.js';
+export declare const CHURN_STALE_RANK_MULTIPLIER = 0.5;
+export declare function churnStaleFactor(entry: MemoryEntry): number;
 export declare function tokenize(text: string): string[];
 /**
  * Tokenized BM25 corpus. Callers can pre-build this with `buildCorpus` once
@@ -119,6 +121,8 @@ export interface ScoreBreakdown {
      *  to [0.85, 1.15]. Immediate nudge from `hippo outcome --good/--bad`.
      *  Separate from the slow strength-via-reward-factor path. */
     outcomeBoost: number;
+    /** FE2: CHURN_STALE_RANK_MULTIPLIER if tagged 'churn-stale', else 1.0. */
+    churnStaleMultiplier: number;
     /** Pre-MMR rank (1-indexed). Only set when MMR re-ranking ran. */
     preMmrRank?: number;
     /** Post-MMR rank (1-indexed). Only set when MMR re-ranking ran. */