hippo-memory 1.58.0 → 1.60.0

package/dist/compaction-record.js

@@ -12,6 +12,7 @@ import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
 import { maskEmails, redactSecretsStrict } from './secret-detect.js';
 import { strengthenRetrievedOn, updateStats, writeEntryMirrors } from './store.js';
 import { resolveTenantId } from './tenant.js';
+import { log as logger } from './log.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
@@ -262,7 +263,7 @@ export function parsePostCompactPayload(stdinText) {
         raw = JSON.parse((stdinText ?? '').trim());
     }
     catch {
-        return null;
+        return null; // non-JSON stdin is not a PostCompact payload; the caller skips it
     }
     if (!isObjectLike(raw) || !('session_id' in raw) || !isStringValue(raw.session_id) || raw.session_id === '')
         return null;
@@ -309,7 +310,7 @@ export function saveCompaction(hippoRoot, payload, log) {
             if (isSqliteBusy(err))
                 throw err;
             log(`record step failed: ${errorMessage(err)}`);
-            console.error(`hippo post-compact: record step failed: ${errorMessage(err)}`);
+            logger.error(`post-compact: record step failed: ${errorMessage(err)}`);
         }
         try {
             result.written = saveItems(db, hippoRoot, {
@@ -337,12 +338,12 @@ export function saveCompaction(hippoRoot, payload, log) {
             }
             catch (spoolErr) {
                 log(`spool failed: ${errorMessage(spoolErr)}`);
-                console.error(`hippo post-compact: spool failed: ${errorMessage(spoolErr)}`);
+                logger.error(`post-compact: spool failed: ${errorMessage(spoolErr)}`);
             }
         }
         else {
             log(`items step failed: ${errorMessage(err)}`);
-            console.error(`hippo post-compact: items step failed: ${errorMessage(err)}`);
+            logger.error(`post-compact: items step failed: ${errorMessage(err)}`);
         }
     }
     finally {
@@ -380,7 +381,7 @@ function transcriptSummary(transcriptPath, afterMs, beforeMs) {
                 lines.push(JSON.parse(raw));
             }
             catch {
-                continue;
+                continue; // the tail can start mid-line; a torn line holds no summary
             }
         }
         const stamp = (line) => (isStringValue(line.timestamp) ? Date.parse(line.timestamp) : Number.NaN);
@@ -409,7 +410,7 @@ function readSpooled(file, fallbackTenantId) {
         raw = JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
-        return null;
+        return null; // a half-written or vanished spool file is skipped; the caller treats null as unreadable
     }
     if (!isObjectLike(raw) || !('sessionId' in raw) || !isStringValue(raw.sessionId) || !('summary' in raw) || !isStringValue(raw.summary))
         return null;

package/dist/config.js

@@ -5,6 +5,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { DEFAULT_PHYSICS_CONFIG, mergePhysicsConfig } from './physics-config.js';
 import { DEFAULT_HALF_LIFE_DAYS } from './memory.js';
+import { log } from './log.js';
 const DEFAULT_CONFIG = {
     defaultHalfLifeDays: DEFAULT_HALF_LIFE_DAYS,
     defaultBudget: 4000,
@@ -114,7 +115,7 @@ function deliveryLedgerEnabled(value) {
         return enabled;
     if (isObject && enabled === undefined)
         return false;
-    console.error(`Warning: config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
+    log.warn(`config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
         `(got ${JSON.stringify(value)}) - using false.`);
     return false;
 }
@@ -127,7 +128,7 @@ function pilotHoldoutRate(value) {
         return 0;
     if (Number.isInteger(rate) && rate >= 0 && rate <= 10000)
         return rate;
-    console.error(`Warning: config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
+    log.warn(`config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
         `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
     return 0;
 }
@@ -136,7 +137,7 @@ function agentMemoryTools(value) {
         return null;
     if (Array.isArray(value) && value.every((t) => String(t) === t))
         return value;
-    console.error(`Warning: config.json's "agentMemories.tools" must be a list of tool ids like ["claude-code", "codex"] ` +
+    log.warn(`config.json's "agentMemories.tools" must be a list of tool ids like ["claude-code", "codex"] ` +
         `(got ${JSON.stringify(value)}) - importing none.`);
     return [];
 }
@@ -158,7 +159,7 @@ export function loadConfig(hippoRoot) {
         const memoryValueRaw = raw.memoryValue;
         const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
         if (!validMemoryValueConfig) {
-            console.error(`Warning: config.json's "memoryValue" must be an object like {"enabled": true} ` +
+            log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
                 `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
         }
         const memoryValueOverride = memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
@@ -167,20 +168,20 @@ export function loadConfig(hippoRoot) {
         // warns and falls back to the default, which keeps faded memories.
         const dormantRaw = raw.dormant;
         if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
-            console.error(`Warning: config.json's "dormant" must be an object like {"enabled": false} ` +
+            log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
                 `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
         }
         const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
         // Only a real boolean counts: {"enabled": "false"} is a truthy string.
         let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
         if (dormantEnabled !== true && dormantEnabled !== false) {
-            console.error(`Warning: config.json's "dormant.enabled" must be true or false ` +
+            log.warn(`config.json's "dormant.enabled" must be true or false ` +
                 `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
             dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
         }
         let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
         if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
-            console.error(`Warning: config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
+            log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
                 `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
             dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
         }
@@ -188,21 +189,21 @@ export function loadConfig(hippoRoot) {
         const churnStalenessRaw = raw.churnStaleness;
         const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
         if (!validChurnStalenessConfig) {
-            console.error(`Warning: config.json's "churnStaleness" must be an object like {"enabled": true} ` +
+            log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
                 `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
         }
         let churnStalenessEnabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
             ? churnStalenessRaw.enabled
             : DEFAULT_CONFIG.churnStaleness.enabled;
         if (churnStalenessEnabled !== true && churnStalenessEnabled !== false) {
-            console.error(`Warning: config.json's "churnStaleness.enabled" must be true or false ` +
+            log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
                 `(got ${JSON.stringify(churnStalenessEnabled)}) - using false.`);
             churnStalenessEnabled = false;
         }
         // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
         let defaultHalfLifeDays = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
         if (!Number.isFinite(defaultHalfLifeDays) || defaultHalfLifeDays <= 0) {
-            console.error(`Warning: config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
+            log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
                 `(got ${JSON.stringify(defaultHalfLifeDays)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
             defaultHalfLifeDays = DEFAULT_CONFIG.defaultHalfLifeDays;
         }
@@ -247,7 +248,7 @@ export function loadConfig(hippoRoot) {
     }
     catch (err) {
         if (fs.existsSync(configPath)) {
-            console.error(`Warning: failed to parse ${configPath}: ${err instanceof Error ? err.message : err}`);
+            log.warn(`failed to parse ${configPath}: ${err instanceof Error ? err.message : err}`);
         }
         return { ...DEFAULT_CONFIG };
     }

package/dist/connectors/github/cli-impl.js

@@ -52,6 +52,7 @@ function parsedToIngestEvent(parsed, eventName) {
     }
     return null;
 }
+// Console lines below are the `hippo github` command's printed result and usage text, so they stay off the logger.
 export function printGithubBackfillUsage() {
     console.log('hippo github backfill --repo <owner/name> [--since ISO] [--max <N>]');
     console.log('  --repo   GitHub repository in owner/name format (required, e.g. acme/widgets)');

package/dist/consolidate.js

@@ -31,6 +31,7 @@ import { migrateDefaultHalfLife, LEGACY_TYPED_HALF_LIFE } from './half-life-migr
 import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
 import { isQuarantineScope } from './quarantine.js';
 import { NO_MERGE_TAGS } from './shared.js';
+import { log } from './log.js';
 const DECAY_THRESHOLD = 0.05;
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
@@ -434,7 +435,7 @@ export async function consolidate(hippoRoot, options = {}) {
                 result.details.push(`  🧬 promoted ${result.promotedTraces} trace${result.promotedTraces === 1 ? '' : 's'} from completed session${result.promotedTraces === 1 ? '' : 's'}`);
             }
             if (tracesSkippedRejected > 0) {
-                console.error(`consolidate: skipped ${tracesSkippedRejected} auto-promoted trace(s) whose content matches a rejected value`);
+                log.warn(`consolidate: skipped ${tracesSkippedRejected} auto-promoted trace(s) whose content matches a rejected value`);
             }
         }
         // -------------------------------------------------------------------------
@@ -490,7 +491,7 @@ export async function consolidate(hippoRoot, options = {}) {
                 return;
             llmErrorsSeen.add(line);
             result.details.push(line);
-            console.error(`consolidate ${phase}: ${msg}`);
+            log.warn(`consolidate ${phase}: ${msg}`);
         };
         const llmOpts = { apiKey, model: config.extraction.model, fetcher: options.fetcher };
         if (apiKey && extractionCandidates.length > 0 && !dryRun) {
@@ -689,7 +690,7 @@ export async function consolidate(hippoRoot, options = {}) {
         // before this fix — byte-identical behavior there.
         const mergeCandidatesByTenant = new Map();
         for (const entry of mergeCandidates) {
-            const key = derivationPartitionKey(entry.tenantId, entry.scope);
+            const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
             const bucket = mergeCandidatesByTenant.get(key);
             if (bucket)
                 bucket.push(entry);
@@ -708,6 +709,7 @@ export async function consolidate(hippoRoot, options = {}) {
         for (const [, tenantCandidates] of mergeCandidatesByTenant) {
             const mergeTenant = tenantCandidates[0].tenantId;
             const mergeScope = derivationScope(tenantCandidates[0].scope);
+            const mergeOrigin = tenantCandidates[0].origin_project;
             const partnersOf = mergePartners(tenantCandidates.map((e) => e.content));
             for (let i = 0; i < tenantCandidates.length; i++) {
                 if (used.has(tenantCandidates[i].id) || tenantCandidates[i].content.length > MERGE_MAX_CHARS)
@@ -752,6 +754,7 @@ export async function consolidate(hippoRoot, options = {}) {
                             scope: mergeScope,
                             baseHalfLifeDays: config.defaultHalfLifeDays,
                         }),
+                        origin_project: mergeOrigin,
                         parents: cluster.map((e) => e.id),
                     };
                 }
@@ -829,7 +832,7 @@ export async function consolidate(hippoRoot, options = {}) {
             closeHippoDb(consolidateDbHandle);
     }
     if (mergesSkippedRejected > 0) {
-        console.error(`consolidate: skipped ${mergesSkippedRejected} merge(s) whose content matches a rejected value`);
+        log.warn(`consolidate: skipped ${mergesSkippedRejected} merge(s) whose content matches a rejected value`);
     }
     result.removedIds = pendingDeletes;
     // One transaction; the snapshot keeps what the DAG passes and other writers changed while sleep ran.
@@ -994,6 +997,8 @@ rescuedIds = new Set()) {
                 continue;
             if (survivors[i].superseded_by || survivors[j].superseded_by)
                 continue;
+            if (!recalledTogether(survivors[i], survivors[j]))
+                continue;
             if ([survivors[i], survivors[j]].some((e) => e.tags.includes('extracted') || e.tags.includes('session-digest')))
                 continue;
             const reasonAndScore = describeConflict(profiles[i], profiles[j]);
@@ -1009,6 +1014,13 @@ rescuedIds = new Set()) {
     }
     return detected;
 }
+/** One project's ambient context can show both: same tenant, and the same project or a user-global row beside a project's. */
+function recalledTogether(a, b) {
+    if (a.tenantId !== b.tenantId)
+        return false;
+    const [x, y] = [a.origin_project ?? null, b.origin_project ?? null];
+    return x === y || (x === '' && y !== null) || (y === '' && x !== null);
+}
 function conflictProfile(text) {
     const opening = openingWindow(text);
     // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray

package/dist/dag.js

@@ -1,11 +1,12 @@
 import { createMemory, Layer } from './memory.js';
 import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
 import { RejectedValueError } from './rejection.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { derivationScope, derivationPartitionKey } from './recall-scope.js';
 import { loadConfig } from './config.js';
 import { neverAutoShareTags } from './shared.js';
+import { log } from './log.js';
 export function clusterFacts(facts) {
     if (facts.length === 0)
         return [];
@@ -47,9 +48,9 @@ Write a single concise paragraph (2-4 sentences) that captures all the key infor
 export async function generateDagSummary(label, factContents, opts) {
     const model = opts.model ?? 'claude-sonnet-4-6';
     const fetchFn = opts.fetcher ?? fetch;
-    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecrets(f)}`).join('\n');
+    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecretsStrict(f)}`).join('\n');
     const prompt = DAG_SUMMARY_PROMPT
-        .replace('{label}', redactSecrets(label))
+        .replace('{label}', redactSecretsStrict(label))
         .replace('{facts}', factsBlock);
     let res;
     try {
@@ -98,7 +99,7 @@ export async function buildDag(hippoRoot, facts, opts) {
     // behavior there.
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
-        const key = derivationPartitionKey(fact.tenantId, fact.scope);
+        const key = derivationPartitionKey(fact.tenantId, fact.scope, fact.origin_project);
         const bucket = unparentedByTenant.get(key);
         if (bucket)
             bucket.push(fact);
@@ -129,6 +130,7 @@ export async function buildDag(hippoRoot, facts, opts) {
                 scope: factScope,
                 baseHalfLifeDays,
             });
+            summaryEntry.origin_project = tenantFacts[0].origin_project;
             // Schema v25: cache descendant_count + earliest/latest_at on the summary
             // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
             // can reason about scope without walking the children.
@@ -156,7 +158,7 @@ export async function buildDag(hippoRoot, facts, opts) {
             catch (err) {
                 if (err instanceof RejectedValueError) {
                     result.rejected++;
-                    console.error(`[buildDag] cluster "${cluster.label}" skipped: summary matches a rejected value`);
+                    log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
                     continue;
                 }
                 throw err;
@@ -273,8 +275,7 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             // (audit() wraps its own writes try/catch per store.ts:2566, so a
             // throw here is exotic: SQLite I/O error, prepare failure, etc).
             result.failed++;
-            // eslint-disable-next-line no-console
-            console.error(`[rebuildDirtySummaries] summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+            log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return result;
@@ -310,7 +311,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const byTenant = new Map();
     for (const l2 of unparented) {
         const tid = l2.tenantId ?? 'default';
-        const key = derivationPartitionKey(tid, l2.scope);
+        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
         const list = byTenant.get(key) ?? [];
         list.push(l2);
         byTenant.set(key, list);
@@ -338,6 +339,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
                 scope,
                 baseHalfLifeDays,
             });
+            profileEntry.origin_project = tenantL2s[0].origin_project;
             profileEntry.descendant_count = cluster.members.length;
             profileEntry.earliest_at = memberCreatedAts[0];
             profileEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
@@ -351,7 +353,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
             catch (err) {
                 if (err instanceof RejectedValueError) {
                     result.rejected++;
-                    console.error(`[buildEntityProfiles] cluster "${cluster.label}" skipped: profile matches a rejected value`);
+                    log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
                     continue;
                 }
                 throw err;

package/dist/dashboard.js

@@ -18,6 +18,7 @@ import { loadEmbeddingIndex } from './embeddings.js';
 import { resolveTenantId } from './tenant.js';
 import { loadCardDetail } from './card-detail.js';
 import { isCrossSite, LOOPBACK_HOST_HEADER } from './server.js';
+import { log } from './log.js';
 function buildDashboardData(hippoRoot) {
     // A5: scope dashboard to active tenant. Without this, the UI surfaces every
     // tenant's memories on a multi-tenant deployment.
@@ -152,7 +153,7 @@ function serveStaticFile(res, filePath) {
         return true;
     }
     catch {
-        return false;
+        return false; // an unreadable asset falls through to the next route, which answers 404 or the fallback page
     }
 }
 export function serveDashboard(hippoRoot, port = 3333) {
@@ -249,7 +250,7 @@ export function serveDashboard(hippoRoot, port = 3333) {
             handleRequest(req, res);
         }
         catch (err) {
-            console.error('Dashboard request failed:', err);
+            log.error(`dashboard request failed: ${err instanceof Error ? err.message : String(err)}`);
             if (res.headersSent)
                 res.end();
             else
@@ -257,6 +258,7 @@ export function serveDashboard(hippoRoot, port = 3333) {
         }
     });
     server.listen(port, '127.0.0.1', () => {
+        // The banner is the `hippo dashboard` command's printed result, so it stays on stdout.
         console.log(`Hippo Dashboard running at http://localhost:${port}`);
         if (hasDistUi)
             console.log(`Serving React UI from ${distUiDir}`);

package/dist/db.js

@@ -12,7 +12,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 50;
+const CURRENT_SCHEMA_VERSION = 51;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2568,6 +2568,19 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 51,
+        up: (db) => {
+            // Both indexes serve loadAmbientCandidates (src/store.ts); their WHERE text must match its SQL for the planner to pick them.
+            // The drift index stays empty on a healthy store, so the drift probe is one index seek instead of a tenant scan. Additive only.
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_memories_pinned
+          ON memories(tenant_id, created, id) WHERE pinned = 1;
+        CREATE INDEX IF NOT EXISTS idx_memories_created_drift
+          ON memories(tenant_id) WHERE superseded_by IS NULL AND (length(created) <> 24 OR created NOT LIKE '%Z');
+      `);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))
@@ -2700,7 +2713,7 @@ function openOwnHippoDb(hippoRoot, opts) {
             cleanupArchivedMirrors(hippoRoot, db);
         }
         catch (cleanupErr) {
-            console.error('openHippoDb: cleanupArchivedMirrors failed (non-fatal):', cleanupErr);
+            log.error(`openHippoDb: cleanupArchivedMirrors failed (non-fatal): ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`);
         }
         return db;
     }
@@ -2964,7 +2977,7 @@ function ensureOptionalFts(db) {
         available = true;
     }
     catch (err) {
-        console.error(`hippo: full-text index unavailable (${err instanceof Error ? err.message : String(err)}); search falls back to slower LIKE matching`);
+        log.warn(`full-text index unavailable (${err instanceof Error ? err.message : String(err)}); search falls back to slower LIKE matching`);
     }
     // Read-first: only write when the flag actually changed, so a healthy
     // store's open doesn't take a write lock for a same-value upsert.

package/dist/dedupe.js

@@ -78,7 +78,7 @@ export function deduplicateStore(hippoRoot, options = {}) {
     const entriesByTenant = new Map();
     for (const entry of entries) {
         // EI2: also split by restricted scope, else a private copy can delete the readable one.
-        const key = derivationPartitionKey(entry.tenantId, entry.scope);
+        const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
         const bucket = entriesByTenant.get(key);
         if (bucket)
             bucket.push(entry);

package/dist/delivery-recorder.js

@@ -205,6 +205,7 @@ export function createDeliveryRecorder(init) {
                 return;
             flushed = true;
             if (broken !== null) {
+                // Same pinned `[hippo] delivery ledger` hook stderr line as recall-trace.ts's write failure.
                 console.error(`[hippo] delivery ledger skipped: recorder failed: ${broken}`);
                 return;
             }

package/dist/doctor.js

@@ -15,6 +15,8 @@ import { openHippoDbReadOnly, closeHippoDb, getSchemaVersion, getCurrentSchemaVe
 import { REPLAY_AFTER_MS, TRANSCRIPT_FILL_WINDOW_MS } from './compaction-record.js';
 import { isEmbeddingAvailable } from './embeddings.js';
 import { CODEX_TRUST_LINE, codexHomeDir, isCodexPresent, isJsonObject } from './hooks.js';
+import { planUserGlobalRepair } from './project-merge.js';
+import { resolveTenantId } from './tenant.js';
 /** Minimum Node.js version hippo supports (package.json engines). */
 export const MIN_NODE = '22.16.0';
 function versionAtLeast(actual, min) {
@@ -34,6 +36,7 @@ function readJson(file) {
         return JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
+        // A missing or corrupt file is the finding doctor reports, so null is the answer.
         return null;
     }
 }
@@ -128,6 +131,25 @@ function compactionsCheck(db, now) {
             : { id: 'compactions', status: 'warn', detail: `cannot read the compaction records: ${message}` };
     }
 }
+/** Merged rows older sleep saved as user-global, counted by the repair's own dry run so a truly user-global merge never warns. */
+function projectsCheck(globalRoot) {
+    let db = null;
+    try {
+        db = openHippoDbReadOnly(globalRoot);
+        const r = planUserGlobalRepair(db, resolveTenantId({}));
+        const n = r.toProject.length + r.setAside.length;
+        return n === 0
+            ? { id: 'projects', status: 'pass', detail: 'no merged memories in the global store are tagged user-global by mistake' }
+            : { id: 'projects', status: 'warn', detail: `${n} merged memories in the global store are tagged user-global, so every project's context can show them`, fix: 'hippo projects repair --global   (dry run; add --apply to write)' };
+    }
+    catch (err) {
+        return { id: 'projects', status: 'info', detail: `project tags not checked (${err instanceof Error ? err.message : String(err)})` };
+    }
+    finally {
+        if (db !== null)
+            closeHippoDb(db);
+    }
+}
 /** Run every check. Never throws for a broken install; broken parts become failed checks. */
 export function runDoctor(opts) {
     const cwd = opts.cwd ?? process.cwd();
@@ -213,6 +235,8 @@ export function runDoctor(opts) {
     if (holdoutRateBp > 0) {
         checks.push({ id: 'pilot', status: 'info', detail: `pilot holdout on: about ${holdoutRateBp / 100}% of sessions get no memories pushed by hippo (pilot.holdoutRateBp=${holdoutRateBp})` });
     }
+    if (hasGlobal)
+        checks.push(projectsCheck(globalRoot));
     const claudeDir = path.join(home, '.claude');
     if (fs.existsSync(claudeDir)) {
         const settings = readJson(path.join(claudeDir, 'settings.json'));

package/dist/dormant.d.ts

@@ -19,8 +19,8 @@
  */
 import type { DatabaseSyncLike } from './db.js';
 import type { MemoryEntry } from './memory.js';
-/** Why a memory went dormant: sleep's decay pass, or an imported agent memory whose note was deleted. */
-export type DormantReason = 'decay' | 'source-deleted';
+/** Why a memory went dormant: sleep's decay pass, an imported agent memory whose note was deleted, or `hippo projects repair` splitting a two-project merge. */
+export type DormantReason = 'decay' | 'source-deleted' | 'project-repair';
 /** One memory that sleep is moving out of active memory into the dormant store. */
 export interface DormantMove {
     /** The memory as it stood when it faded; restored verbatim apart from its recall clock. */

package/dist/dormant.js

@@ -36,6 +36,7 @@ function parseSnapshot(row) {
         return entry;
     }
     catch {
+        // A row that will not parse is out of shape, so it is not restorable.
         return null;
     }
 }

package/dist/embedding-provider.js

@@ -32,7 +32,7 @@
  */
 import { getEmbedding, isEmbeddingAvailable, resolveEmbeddingModel, DEFAULT_EMBEDDING_MODEL, } from './embeddings.js';
 import { loadConfig } from './config.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry } from './http-retry.js';
 export const API_PROVIDER_KINDS = ['openai', 'voyage', 'cohere'];
 function isApiProviderKind(x) {
@@ -191,7 +191,7 @@ class ApiEmbeddingProvider {
                     'content-type': 'application/json',
                     authorization: `Bearer ${key}`,
                 },
-                body: JSON.stringify(spec.buildBody(this.model, chunk.map(redactSecrets), role)),
+                body: JSON.stringify(spec.buildBody(this.model, chunk.map(redactSecretsStrict), role)),
             }, { timeoutMs: REQUEST_TIMEOUT_MS });
         }
         catch (err) {
@@ -237,6 +237,7 @@ function readEmbeddingsConfig(hippoRoot) {
         return loadConfig(hippoRoot).embeddings;
     }
     catch {
+        // An unreadable config falls back to provider defaults; loadConfig warns on a bad parse.
         return {};
     }
 }

package/dist/embeddings.js

@@ -147,7 +147,7 @@ function resolveTransformersPackage() {
         return '@xenova/transformers';
     }
     catch {
-        return null;
+        return null; // neither optional package is installed; callers fall back to no local embeddings
     }
 }
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -177,7 +177,8 @@ async function loadPipeline(model) {
             }
             pipelineFn = mod.pipeline ?? mod.default?.pipeline;
         }
-        catch {
+        catch (err) {
+            log.debug(`transformers import failed (${pkg}): ${err instanceof Error ? err.message : String(err)}`);
             return null;
         }
         if (!pipelineFn)
@@ -193,7 +194,8 @@ async function loadPipeline(model) {
             _pipelineInstances.set(model, instance);
             return instance;
         }
-        catch {
+        catch (err) {
+            log.debug(`embedding pipeline load failed (${model}): ${err instanceof Error ? err.message : String(err)}`);
             return null;
         }
         finally {
@@ -228,7 +230,8 @@ function loadStoredEmbeddingModel(hippoRoot) {
             closeHippoDb(db);
         }
     }
-    catch {
+    catch (err) {
+        log.debug(`stored embedding model unreadable: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
 }
@@ -363,7 +366,7 @@ function parseEmbeddingIndex(raw) {
         return parsed instanceof Object && !Array.isArray(parsed) ? parsed : null;
     }
     catch {
-        return null;
+        return null; // the caller quarantines the corrupt file and logs it
     }
 }
 /** Move a corrupt index aside and flag a full rebuild, so no later save can write over the only copy of those bytes. */
@@ -523,7 +526,7 @@ function warnEmbedFailureOnce(source, rawMessage) {
     _embedFailureWarned = true;
     // Strict scrub: this line can land in a hook log file, and an API may echo the key back in its error body.
     const message = redactSecretsStrict(rawMessage).replace(/\s+/g, ' ').replace(/\.+$/, '');
-    console.error(`hippo: embedding failed (${source}): ${message}. Memories are stored without embeddings until this is fixed.`);
+    log.warn(`embedding failed (${source}): ${message}. Memories are stored without embeddings until this is fixed.`);
 }
 /**
  * Embed a single memory entry and cache the result in the embedding index.
@@ -591,7 +594,7 @@ export async function embedMemory(hippoRoot, entry, model) {
             warnEmbedFailureOnce(provider.kind, err instanceof Error ? err.message : String(err));
         }
     }).catch((err) => {
-        console.error(`hippo: skipped embedding ${entry.id} (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
+        log.warn(`skipped embedding ${entry.id} (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
     });
 }
 /**