hippo-memory 1.57.0 → 1.59.0

package/dist/client.js

@@ -13,6 +13,8 @@
  * Network errors (ECONNREFUSED on a stale pidfile, etc.) propagate as the
  * native fetch failure so the caller can detect them and self-heal.
  */
+/** A write the local server has not answered in this long is stuck; the caller treats it as delivery-unknown. */
+const SERVER_TIMEOUT_MS = 30_000;
 function buildHeaders(apiKey, withBody) {
     const headers = {};
     if (withBody)
@@ -58,6 +60,7 @@ export async function remember(serverUrl, apiKey, opts) {
     const res = await fetch(`${serverUrl}/v1/memories`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify(opts),
     });
     if (!res.ok)
@@ -69,6 +72,7 @@ export async function forget(serverUrl, apiKey, id) {
     const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
         method: 'DELETE',
         headers: buildHeaders(apiKey, false),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -79,6 +83,7 @@ export async function promote(serverUrl, apiKey, id) {
     const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
         method: 'POST',
         headers: buildHeaders(apiKey, false),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -89,6 +94,7 @@ export async function archiveRaw(serverUrl, apiKey, id, reason) {
     const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify({ reason }),
     });
     if (!res.ok)
@@ -123,6 +129,9 @@ export function classifyTransportFailure(err) {
     }
     if (message.includes('socket hang up') || message.includes('fetch failed'))
         return 'delivery-unknown';
+    // The request was sent and the server went quiet, so it may have committed.
+    if (err.name === 'TimeoutError')
+        return 'delivery-unknown';
     return 'none';
 }
 //# sourceMappingURL=client.js.map

package/dist/codex-patch.js

@@ -1,7 +1,7 @@
 // Files named by a Codex apply_patch call, read the way openai/codex codex-rs/apply-patch reads them
 // (parser.rs for the body, invocation.rs for the shell forms it runs as apply_patch).
 import * as path from 'path';
-import { isStringValue } from './capture.js';
+import { isStringValue } from './capture-contract.js';
 /** Codex prints this line only when a patch applied (apply-patch lib.rs). */
 export const PATCH_SUCCESS_LINE = 'Success. Updated the following files:';
 const BEGIN_PATCH = '*** Begin Patch';

package/dist/compaction-record.d.ts

@@ -2,7 +2,7 @@ import { type DatabaseSyncLike } from './db.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export declare const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
-export declare const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo'. Write '- none' if nothing new remains.";
+export declare const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo', and anything this session already saved with `hippo remember`. Write '- none' if nothing new remains.";
 /** Long enough that a live hook has finished with its own record. */
 export declare const REPLAY_AFTER_MS: number;
 /** Claude Code deletes transcripts after 30 days, so an older gap can never be filled. */

package/dist/compaction-record.js

@@ -1,7 +1,8 @@
 // One record per Claude Code compaction, and what turns its summary into kept memories.
 import * as fs from 'fs';
 import * as path from 'path';
-import { errorMessage, isObjectLike, isStringValue, readTranscriptTail, truncateCodePointSafe } from './capture.js';
+import { errorMessage, readTranscriptTail, truncateCodePointSafe } from './capture.js';
+import { isObjectLike, isStringValue } from './capture-contract.js';
 import { compactSummaryBody, parseCompactionItems, selectItemRows } from './compaction-items.js';
 import { loadConfig } from './config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb } from './db.js';
@@ -14,7 +15,7 @@ import { resolveTenantId } from './tenant.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
-export const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo'. Write '- none' if nothing new remains.";
+export const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo', and anything this session already saved with `hippo remember`. Write '- none' if nothing new remains.";
 const SUMMARY_MAX_CHARS = 256 * 1024;
 /** Long enough that a live hook has finished with its own record. */
 export const REPLAY_AFTER_MS = 10 * 60_000;

package/dist/config.d.ts

@@ -145,6 +145,11 @@ export interface HippoConfig {
     deliveryLedger: {
         enabled: boolean;
     };
+    /** Pilot holdout (src/pilot-arm.ts): share of sessions, in basis points 0-10000, that get no memories pushed.
+     *  Default 0 = off. Read from the store the token ledger writes to. */
+    pilot: {
+        holdoutRateBp: number;
+    };
 }
 export declare function loadConfig(hippoRoot: string): HippoConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -88,6 +88,9 @@ const DEFAULT_CONFIG = {
     deliveryLedger: {
         enabled: false,
     },
+    pilot: {
+        holdoutRateBp: 0,
+    },
 };
 function isMemoryValueConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -115,6 +118,19 @@ function deliveryLedgerEnabled(value) {
         `(got ${JSON.stringify(value)}) - using false.`);
     return false;
 }
+// Only an integer 0..10000 counts; anything else warns and turns the pilot off.
+function pilotHoldoutRate(value) {
+    if (value === undefined)
+        return 0;
+    const rate = value?.holdoutRateBp;
+    if (rate === undefined && value !== null && value.constructor === Object)
+        return 0;
+    if (Number.isInteger(rate) && rate >= 0 && rate <= 10000)
+        return rate;
+    console.error(`Warning: config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
+        `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
+    return 0;
+}
 function agentMemoryTools(value) {
     if (value === undefined || value === null)
         return null;
@@ -226,6 +242,7 @@ export function loadConfig(hippoRoot) {
             },
             agentMemories: { tools: agentMemoryTools(raw.agentMemories?.tools) },
             deliveryLedger: { enabled: deliveryLedgerEnabled(raw.deliveryLedger) },
+            pilot: { holdoutRateBp: pilotHoldoutRate(raw.pilot) },
         };
     }
     catch (err) {

package/dist/connectors/github/dlq.js

@@ -1,13 +1,16 @@
 import { openHippoDb, closeHippoDb } from '../../db.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope } from './types.js';
+import { redactPayload, DLQ_REDACTED_NOTE } from '../../secret-detect.js';
 export function writeToDlq(db, opts) {
+    const rawPayload = redactPayload(opts.rawPayload);
+    const redacted = rawPayload !== opts.rawPayload;
     const result = db
         .prepare(`INSERT INTO github_dlq
         (tenant_id, raw_payload, error, event_name, delivery_id, signature,
          installation_id, repo_full_name, received_at, bucket)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(opts.tenantId ?? '__unroutable__', opts.rawPayload, opts.error, opts.eventName ?? null, opts.deliveryId ?? null, opts.signature ?? null, opts.installationId ?? null, opts.repoFullName ?? null, new Date().toISOString(), opts.bucket ?? 'parse_error');
+        .run(opts.tenantId ?? '__unroutable__', rawPayload, redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error, opts.eventName ?? null, opts.deliveryId ?? null, redacted ? null : opts.signature ?? null, opts.installationId ?? null, opts.repoFullName ?? null, new Date().toISOString(), opts.bucket ?? 'parse_error');
     return Number(result.lastInsertRowid);
 }
 const SELECT_COLUMNS = `id, tenant_id, raw_payload, error, event_name, delivery_id,
@@ -107,7 +110,7 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
                 status: 'sig_missing',
                 memoryId: null,
                 retryCount: row.retryCount,
-                reason: 'legacy row without signature; pass --force to replay',
+                reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
             };
         }
         const sigOk = verifyGitHubSignature({

package/dist/connectors/github/octokit-client.js

@@ -10,6 +10,7 @@
  * operator signal, so this code path is now load-bearing.
  */
 import { parseRateLimit } from './ratelimit.js';
+import { fetchWithRetry } from '../../http-retry.js';
 export class GitHubFetchError extends Error {
     status;
     bodyExcerpt;
@@ -42,14 +43,15 @@ function headersToRecord(h) {
     });
     return Object.fromEntries(entries);
 }
+const GITHUB_TIMEOUT_MS = 30_000;
 export const realGitHubFetcher = async ({ url, token }) => {
-    const res = await fetch(url, {
+    const res = await fetchWithRetry(url, {
         headers: {
             Authorization: `Bearer ${token}`,
             Accept: 'application/vnd.github+json',
             'X-GitHub-Api-Version': '2022-11-28',
         },
-    });
+    }, { timeoutMs: GITHUB_TIMEOUT_MS });
     const headers = headersToRecord(res.headers);
     const rateLimit = parseRateLimit(headers, res.status);
     // Codex P1 #4: don't silently turn 401/403/404/500 into empty pages.

package/dist/connectors/slack/dlq.js

@@ -5,12 +5,16 @@ import { resolveTenantForTeam } from './tenant-routing.js';
 import { verifySlackSignature } from './signature.js';
 import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
 import { handleMessageDeleted } from './deletion.js';
+import { redactPayload, DLQ_REDACTED_NOTE } from '../../secret-detect.js';
 export function writeToDlq(db, opts) {
+    const rawPayload = redactPayload(opts.rawPayload);
+    // A redacted body can never match its signature, so the row keeps none and replay needs --force.
+    const redacted = rawPayload !== opts.rawPayload;
     const result = db
         .prepare(`INSERT INTO slack_dlq
         (tenant_id, team_id, raw_payload, error, received_at, bucket, signature, slack_timestamp)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(opts.tenantId ?? '__unroutable__', opts.teamId ?? null, opts.rawPayload, opts.error, new Date().toISOString(), opts.bucket ?? 'parse_error', opts.signature ?? null, opts.slackTimestamp ?? null);
+        .run(opts.tenantId ?? '__unroutable__', opts.teamId ?? null, rawPayload, redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error, new Date().toISOString(), opts.bucket ?? 'parse_error', redacted ? null : opts.signature ?? null, opts.slackTimestamp ?? null);
     return Number(result.lastInsertRowid);
 }
 export function listDlq(db, opts) {
@@ -95,7 +99,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
                 status: 'sig_missing',
                 memoryId: null,
                 retryCount: row.retryCount,
-                reason: 'legacy row without signature/timestamp; pass --force to replay',
+                reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
             };
         }
         if (opts.signingSecret) {

package/dist/connectors/slack/web-client.js

@@ -1,7 +1,8 @@
-import { fetchWithRetry } from './ratelimit.js';
+import { fetchWithRetry, isRetryableStatus } from '../../http-retry.js';
 function isJsonString(value) {
     return typeof value === 'string';
 }
+const SLACK_TIMEOUT_MS = 30_000;
 export function slackHistoryFetcher(token, fetchImpl) {
     return async ({ channelId, cursor, oldest }) => {
         const url = new URL('https://slack.com/api/conversations.history');
@@ -11,11 +12,12 @@ export function slackHistoryFetcher(token, fetchImpl) {
             url.searchParams.set('cursor', cursor);
         if (oldest)
             url.searchParams.set('oldest', oldest);
-        const r = await fetchWithRetry({
-            url: url.toString(),
-            init: { method: 'GET', headers: { authorization: `Bearer ${token}` } },
-            fetchImpl,
+        const r = await fetchWithRetry(url, { method: 'GET', headers: { authorization: `Bearer ${token}` } }, {
+            timeoutMs: SLACK_TIMEOUT_MS,
+            fetchFn: fetchImpl,
         });
+        if (isRetryableStatus(r.status))
+            throw new Error(`slack: still rate-limited or unavailable (HTTP ${r.status})`);
         // SAFETY: body is the Slack `conversations.history` response; per the
         // documented shape it's `{ ok, error?, messages?, response_metadata? }`.
         const body = (await r.json());

package/dist/consolidate.d.ts

@@ -6,6 +6,7 @@
  * 2. Merge pass  - find episodic entries with high text overlap, create semantic summaries
  * 3. Stats tracking
  */
+import { MemoryEntry, type DecayOptions } from './memory.js';
 export interface ConsolidationResult {
     decayed: number;
     removed: number;
@@ -45,4 +46,13 @@ export declare function consolidate(hippoRoot: string, options?: {
     now?: Date;
     fetcher?: typeof fetch;
 }): Promise<ConsolidationResult>;
+/** Maps i to each j > i, ascending, whose text overlap with i reaches the merge threshold; every text needs at least one token. */
+export declare function mergePartners(contents: readonly string[]): (i: number) => number[];
+/** Pairs of live non-semantic memories that contradict each other, in survivor order. */
+export declare function detectConflicts(entries: MemoryEntry[], now: Date, decayOpts?: DecayOptions, rescuedIds?: Set<string>): Array<{
+    memory_a_id: string;
+    memory_b_id: string;
+    reason: string;
+    score: number;
+}>;
 //# sourceMappingURL=consolidate.d.ts.map

package/dist/consolidate.js

@@ -9,8 +9,8 @@
 import { evalNow, isRecallBoostAblated } from './ablation.js';
 import { Layer, calculateStrength, canAutoDelete, createMemory, markRetrieved } from './memory.js';
 import { loadAllEntries, batchWriteAndDelete, appendConsolidationRun, replaceDetectedConflicts, loadSessionDecayContext, incrementSleepCount, findPromotableSessions, traceExistsForSession, listSessionEvents, memoriesBackingObjects, } from './store.js';
-import { textOverlap } from './search.js';
 import { tokenize } from './tokenize.js';
+import { jaccardMinShared, overlapPartners } from './overlap-index.js';
 import { compareEntryIdentity } from './compare.js';
 import { duplicateKey, mergedText } from './same-text.js';
 import { successorAfterRetirement } from './merged-row.js';
@@ -26,7 +26,7 @@ import { renderTraceContent } from './trace.js';
 import { resolveTenantId } from './tenant.js';
 import { rescueSet, rankNonPinnedByTenant, validateWeights } from './memory-value.js';
 import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
-import { appendAuditEvent } from './audit.js';
+import { appendAuditEvent, reportAuditWriteFailure } from './audit.js';
 import { migrateDefaultHalfLife, LEGACY_TYPED_HALF_LIFE } from './half-life-migration.js';
 import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
 import { isQuarantineScope } from './quarantine.js';
@@ -419,8 +419,8 @@ export async function consolidate(hippoRoot, options = {}) {
                                 },
                             });
                         }
-                        catch {
-                            // Best-effort — mirrors store.ts's audit() semantics.
+                        catch (error) {
+                            reportAuditWriteFailure('reject_refusal', String(error));
                         }
                         continue;
                     }
@@ -689,7 +689,7 @@ export async function consolidate(hippoRoot, options = {}) {
         // before this fix — byte-identical behavior there.
         const mergeCandidatesByTenant = new Map();
         for (const entry of mergeCandidates) {
-            const key = derivationPartitionKey(entry.tenantId, entry.scope);
+            const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
             const bucket = mergeCandidatesByTenant.get(key);
             if (bucket)
                 bucket.push(entry);
@@ -708,17 +708,15 @@ export async function consolidate(hippoRoot, options = {}) {
         for (const [, tenantCandidates] of mergeCandidatesByTenant) {
             const mergeTenant = tenantCandidates[0].tenantId;
             const mergeScope = derivationScope(tenantCandidates[0].scope);
+            const mergeOrigin = tenantCandidates[0].origin_project;
+            const partnersOf = mergePartners(tenantCandidates.map((e) => e.content));
             for (let i = 0; i < tenantCandidates.length; i++) {
                 if (used.has(tenantCandidates[i].id) || tenantCandidates[i].content.length > MERGE_MAX_CHARS)
                     continue;
                 const related = [tenantCandidates[i]];
-                for (let j = i + 1; j < tenantCandidates.length; j++) {
-                    if (used.has(tenantCandidates[j].id))
-                        continue;
-                    const overlap = textOverlap(tenantCandidates[i].content, tenantCandidates[j].content);
-                    if (overlap >= MERGE_OVERLAP_THRESHOLD) {
+                for (const j of partnersOf(i)) {
+                    if (!used.has(tenantCandidates[j].id))
                         related.push(tenantCandidates[j]);
-                    }
                 }
                 const cluster = [];
                 let clusterChars = 0;
@@ -755,6 +753,7 @@ export async function consolidate(hippoRoot, options = {}) {
                             scope: mergeScope,
                             baseHalfLifeDays: config.defaultHalfLifeDays,
                         }),
+                        origin_project: mergeOrigin,
                         parents: cluster.map((e) => e.id),
                     };
                 }
@@ -793,8 +792,8 @@ export async function consolidate(hippoRoot, options = {}) {
                                 },
                             });
                         }
-                        catch {
-                            // Best-effort — mirrors store.ts's audit() semantics.
+                        catch (error) {
+                            reportAuditWriteFailure('reject_refusal', String(error));
                         }
                         continue;
                     }
@@ -911,8 +910,9 @@ export async function consolidate(hippoRoot, options = {}) {
                                     : {},
                             });
                         }
-                        catch {
+                        catch (error) {
                             auditFailures++;
+                            reportAuditWriteFailure('mv_rescue', String(error), entry.id);
                         }
                     }
                     if (auditFailures > 0) {
@@ -965,7 +965,14 @@ function pickStrongestValence(entries) {
     }
     return 'neutral';
 }
-function detectConflicts(entries, now, decayOpts = {}, 
+/** Maps i to each j > i, ascending, whose text overlap with i reaches the merge threshold; every text needs at least one token. */
+export function mergePartners(contents) {
+    const sets = contents.map((text) => new Set(tokenize(text)));
+    const candidatesOf = overlapPartners(sets, jaccardMinShared(MERGE_OVERLAP_THRESHOLD));
+    return (i) => candidatesOf(i).filter((j) => jaccardSets(sets[i], sets[j]) >= MERGE_OVERLAP_THRESHOLD);
+}
+/** Pairs of live non-semantic memories that contradict each other, in survivor order. */
+export function detectConflicts(entries, now, decayOpts = {}, 
 // LC2-E3 (opt-in, default off): ids rescued by this cycle's decay pass.
 // detectConflicts recomputes its own strength>=DECAY_THRESHOLD survivor
 // filter independently of the decay pass above; without this bypass,
@@ -978,8 +985,10 @@ rescuedIds = new Set()) {
         && !isQuarantineScope(entry.scope ?? null)
         && (rescuedIds.has(entry.id) || calculateStrength(entry, now, decayOpts) >= DECAY_THRESHOLD));
     const detected = [];
+    const profiles = survivors.map((entry) => conflictProfile(entry.content));
+    const partnersOf = overlapPartners(profiles.map((p) => p.distinct), jaccardMinShared(CONFLICT_OVERLAP_THRESHOLD, CONFLICT_MIN_RARE_SHARED));
     for (let i = 0; i < survivors.length; i++) {
-        for (let j = i + 1; j < survivors.length; j++) {
+        for (const j of partnersOf(i)) {
             // Traces are variants of each other, not contradictions. Two
             // strategies for the same task can both be valid; conflict detection
             // exists for stated-rule disagreement, not strategy diversity.
@@ -987,9 +996,11 @@ rescuedIds = new Set()) {
                 continue;
             if (survivors[i].superseded_by || survivors[j].superseded_by)
                 continue;
+            if (!recalledTogether(survivors[i], survivors[j]))
+                continue;
             if ([survivors[i], survivors[j]].some((e) => e.tags.includes('extracted') || e.tags.includes('session-digest')))
                 continue;
-            const reasonAndScore = describeConflict(survivors[i], survivors[j]);
+            const reasonAndScore = describeConflict(profiles[i], profiles[j]);
             if (!reasonAndScore)
                 continue;
             detected.push({
@@ -1002,25 +1013,33 @@ rescuedIds = new Set()) {
     }
     return detected;
 }
+/** One project's ambient context can show both: same tenant, and the same project or a user-global row beside a project's. */
+function recalledTogether(a, b) {
+    if (a.tenantId !== b.tenantId)
+        return false;
+    const [x, y] = [a.origin_project ?? null, b.origin_project ?? null];
+    return x === y || (x === '' && y !== null) || (y === '' && x !== null);
+}
+function conflictProfile(text) {
+    const opening = openingWindow(text);
+    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray
+    // negation deep in a prose memory doesn't flip the intent.
+    // Pad with spaces so space-delimited patterns match words at the start/end.
+    return { distinct: distinctiveTokens(text), polarity: inferConflictPolarity(opening), window: ' ' + opening.toLowerCase() + ' ' };
+}
 function describeConflict(a, b) {
-    const aDistinct = distinctiveTokens(a.content);
-    const bDistinct = distinctiveTokens(b.content);
     // Jaccard on stopword-stripped tokens. Defer the threshold check until we
     // know whether an explicit polarity pair is present (lower bar for those).
-    const overlapScore = jaccardSets(aDistinct, bDistinct);
+    const overlapScore = jaccardSets(a.distinct, b.distinct);
     // Require at least N shared distinctive tokens so two short memories sharing
     // only "the project name" don't register.
     let shared = 0;
-    for (const t of aDistinct)
-        if (bDistinct.has(t))
+    for (const t of a.distinct)
+        if (b.distinct.has(t))
             shared++;
     if (shared < CONFLICT_MIN_RARE_SHARED)
         return null;
-    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray
-    // negation deep in a prose memory doesn't flip the intent.
-    const polarityA = inferConflictPolarity(openingWindow(a.content));
-    const polarityB = inferConflictPolarity(openingWindow(b.content));
-    const conflictType = classifyConflictType(a.content, b.content, polarityA, polarityB);
+    const conflictType = classifyConflictType(a.window, b.window, a.polarity, b.polarity);
     if (!conflictType)
         return null;
     if (overlapScore < CONFLICT_OVERLAP_THRESHOLD)
@@ -1052,14 +1071,8 @@ function jaccardSets(a, b) {
 function openingWindow(text) {
     return text.split(/\s+/).slice(0, POLARITY_WINDOW_WORDS).join(' ');
 }
-function classifyConflictType(aText, bText, aPolarity, bPolarity) {
-    // Classifier scans only the opening window of each memory so " on " and
-    // " off " used as English prepositions deep in a long prose memory don't
-    // trigger an enabled/disabled flag. The opening window is where a rule or
-    // declaration is typically stated.
-    // Pad with spaces so space-delimited patterns match words at the start/end.
-    const a = ' ' + openingWindow(aText).toLowerCase() + ' ';
-    const b = ' ' + openingWindow(bText).toLowerCase() + ' ';
+// Takes opening windows only, so " on " and " off " as prepositions deep in long prose don't read as enabled/disabled.
+function classifyConflictType(a, b, aPolarity, bPolarity) {
     // Tightened tokens: require whole-word boundaries so " on " alone doesn't
     // match "on/off". Pair only `enabled` ↔ `disabled` and explicit on/off in
     // imperative context.

package/dist/customer-notes.js

@@ -19,6 +19,7 @@
  *
  * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
  */
+import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { writeEntry } from './store.js';
 import { assertTenantId } from './tenant.js';
@@ -47,21 +48,21 @@ export const MAX_CHANGE_SUMMARY_LEN = 4096;
 function validateNoteFields(customer, note, changeSummary) {
     const normalizedCustomer = (customer ?? '').trim();
     if (normalizedCustomer.length === 0)
-        throw new Error('saveCustomerNote: customer is required');
+        throw new BadRequestError('saveCustomerNote: customer is required');
     if (/[\r\n]/.test(normalizedCustomer)) {
-        throw new Error('saveCustomerNote: customer must be a single line (no newlines)');
+        throw new BadRequestError('saveCustomerNote: customer must be a single line (no newlines)');
     }
     if (normalizedCustomer.length > MAX_CUSTOMER_LEN) {
-        throw new Error(`saveCustomerNote: customer exceeds the ${MAX_CUSTOMER_LEN}-char cap`);
+        throw new BadRequestError(`saveCustomerNote: customer exceeds the ${MAX_CUSTOMER_LEN}-char cap`);
     }
     if (!note || note.trim().length === 0) {
-        throw new Error('saveCustomerNote: note is required');
+        throw new BadRequestError('saveCustomerNote: note is required');
     }
     if (note.length > MAX_NOTE_LEN) {
-        throw new Error(`saveCustomerNote: note exceeds the ${MAX_NOTE_LEN}-char cap`);
+        throw new BadRequestError(`saveCustomerNote: note exceeds the ${MAX_NOTE_LEN}-char cap`);
     }
     if (changeSummary !== undefined && changeSummary.length > MAX_CHANGE_SUMMARY_LEN) {
-        throw new Error(`saveCustomerNote: changeSummary exceeds the ${MAX_CHANGE_SUMMARY_LEN}-char cap`);
+        throw new BadRequestError(`saveCustomerNote: changeSummary exceeds the ${MAX_CHANGE_SUMMARY_LEN}-char cap`);
     }
     return { customer: normalizedCustomer };
 }
@@ -137,10 +138,10 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
                 // shape for the matching row, or undefined when no note/tenant pair matches.
                 const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(opts.supersedesNoteId, tenantId);
                 if (!pred) {
-                    throw new Error(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
                 }
                 if (pred.status !== 'active') {
-                    throw new Error(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
+                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
                 }
                 version = pred.version + 1;
             }
@@ -158,7 +159,7 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
           WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
         `).run(noteId, now, opts.supersedesNoteId, tenantId, noteId);
                 if (sup.changes === 0) {
-                    throw new Error(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
+                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
                 }
                 appendAuditEvent(db, {
                     tenantId,
@@ -221,9 +222,9 @@ export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
                 // shape, or undefined when the id/tenant pair doesn't exist.
                 const existing = db.prepare(`SELECT status FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
                 if (!existing) {
-                    throw new Error(`closeCustomerNote: note ${id} not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`closeCustomerNote: note ${id} not found for tenant ${tenantId}`);
                 }
-                throw new Error(`closeCustomerNote: note ${id} is not active (status='${existing.status}'); only active notes can be closed.`);
+                throw new ConflictError(`closeCustomerNote: note ${id} is not active (status='${existing.status}'); only active notes can be closed.`);
             }
             // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
             // .get() returns that row for the just-updated id, or undefined only in an
@@ -231,7 +232,7 @@ export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
             const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ? AND tenant_id = ?`)
                 .get(id, tenantId);
             if (!row)
-                throw new Error(`closeCustomerNote: note ${id} not found after UPDATE`);
+                throw new NotFoundError(`closeCustomerNote: note ${id} not found after UPDATE`);
             appendAuditEvent(db, {
                 tenantId,
                 actor,
@@ -284,7 +285,7 @@ export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadCustomerNotes', tenantId);
     const limit = opts.limit ?? 100;
     if (opts.status && !VALID_NOTE_STATES.has(opts.status)) {
-        throw new Error(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
+        throw new BadRequestError(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
     }
     const db = openHippoDb(hippoRoot);
     try {

package/dist/dag.js

@@ -2,6 +2,7 @@ import { createMemory, Layer } from './memory.js';
 import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
 import { RejectedValueError } from './rejection.js';
 import { redactSecrets } from './secret-detect.js';
+import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { derivationScope, derivationPartitionKey } from './recall-scope.js';
 import { loadConfig } from './config.js';
 import { neverAutoShareTags } from './shared.js';
@@ -52,7 +53,7 @@ export async function generateDagSummary(label, factContents, opts) {
         .replace('{facts}', factsBlock);
     let res;
     try {
-        res = await fetchFn('https://api.anthropic.com/v1/messages', {
+        res = await fetchWithRetry('https://api.anthropic.com/v1/messages', {
             method: 'POST',
             headers: {
                 'content-type': 'application/json',
@@ -64,7 +65,7 @@ export async function generateDagSummary(label, factContents, opts) {
                 max_tokens: 400,
                 messages: [{ role: 'user', content: prompt }],
             }),
-        });
+        }, { timeoutMs: llmTimeoutMs(), fetchFn });
     }
     catch (err) {
         opts.onError?.(`request failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -97,7 +98,7 @@ export async function buildDag(hippoRoot, facts, opts) {
     // behavior there.
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
-        const key = derivationPartitionKey(fact.tenantId, fact.scope);
+        const key = derivationPartitionKey(fact.tenantId, fact.scope, fact.origin_project);
         const bucket = unparentedByTenant.get(key);
         if (bucket)
             bucket.push(fact);
@@ -128,6 +129,7 @@ export async function buildDag(hippoRoot, facts, opts) {
                 scope: factScope,
                 baseHalfLifeDays,
             });
+            summaryEntry.origin_project = tenantFacts[0].origin_project;
             // Schema v25: cache descendant_count + earliest/latest_at on the summary
             // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
             // can reason about scope without walking the children.
@@ -309,7 +311,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const byTenant = new Map();
     for (const l2 of unparented) {
         const tid = l2.tenantId ?? 'default';
-        const key = derivationPartitionKey(tid, l2.scope);
+        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
         const list = byTenant.get(key) ?? [];
         list.push(l2);
         byTenant.set(key, list);
@@ -337,6 +339,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
                 scope,
                 baseHalfLifeDays,
             });
+            profileEntry.origin_project = tenantL2s[0].origin_project;
             profileEntry.descendant_count = cluster.members.length;
             profileEntry.earliest_at = memberCreatedAts[0];
             profileEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];

package/dist/dashboard.js

@@ -29,7 +29,7 @@ function buildDashboardData(hippoRoot) {
     // render resolved conflicts as faded historical context, not just open
     // conflicts. The open_conflicts stat below still counts only 'open' rows
     // to preserve the existing badge meaning.
-    const conflicts = listMemoryConflicts(hippoRoot, '*');
+    const conflicts = listMemoryConflicts(hippoRoot, '*', tenantId);
     // D4 v1.12.10: tenant-scope peer discovery in the dashboard (matches the
     // tenantId already used for loadAllEntries on line 72).
     const peers = listPeers(undefined, tenantId);