hippo-memory 1.60.0 → 1.61.0

package/dist/consolidate/run.d.ts

@@ -0,0 +1,69 @@
+import { MemoryEntry, type DecayOptions } from '../memory.js';
+import { type DatabaseSyncLike } from '../db.js';
+import { type DormantMove } from '../dormant.js';
+import { loadConfig } from '../config.js';
+export interface ConsolidationResult {
+    decayed: number;
+    removed: number;
+    /** Faded memories moved to the dormant store instead of deleted (config
+     *  `dormant.enabled`; src/dormant.ts). Always 0 when that is off. */
+    dormant: number;
+    /** Dormant memories deleted for good this sleep because they outlived
+     *  `dormant.retentionDays` without a restore. */
+    dormantExpired: number;
+    merged: number;
+    semanticCreated: number;
+    replayed: number;
+    promotedTraces: number;
+    /** T7: sessions skipped because their events span two derivation scopes. */
+    tracesSkippedMixedScope: number;
+    extractionCandidates: number;
+    extracted: number;
+    dagCandidateClusters: number;
+    dagSummariesCreated: number;
+    summariesRebuilt: number;
+    summariesRebuildFailed: number;
+    summariesZeroChildSkipped: number;
+    summariesRebuildRefused: number;
+    summariesRebuildCapped: boolean;
+    entityProfilesCreated: number;
+    dryRun: boolean;
+    details: string[];
+    physicsSimulated: number;
+    /** Ids the decay pass removes (or would remove, under dryRun). */
+    removedIds?: string[];
+}
+export declare const REPLAY_COUNT_DEFAULT = 5;
+export declare function keptAsWritten(entry: MemoryEntry): boolean;
+/** JSON value shape for a session event's free-form metadata field, cast to
+ *  once at its `Record<string, unknown>` origin so it can be narrowed via
+ *  isJsonString below rather than left as unparsed `unknown`. */
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare function isJsonString(value: JsonValue): value is string;
+/** The sleep's one tombstone-check handle: opened on first use, never under dryRun, closed once. */
+interface LazyDb {
+    get: () => DatabaseSyncLike | null;
+    close: () => void;
+}
+export declare function lazyConsolidateDb(hippoRoot: string, dryRun: boolean): LazyDb;
+/** State every sleep stage reads or appends to; the pending lists are flushed in one transaction at the end. */
+export interface SleepRun {
+    hippoRoot: string;
+    now: Date;
+    dryRun: boolean;
+    config: ReturnType<typeof loadConfig>;
+    decayOpts: DecayOptions;
+    result: ConsolidationResult;
+    all: MemoryEntry[];
+    retirable: (entry: MemoryEntry) => boolean;
+    getConsolidateDb: () => DatabaseSyncLike | null;
+    survivors: MemoryEntry[];
+    pendingWrites: MemoryEntry[];
+    pendingDeletes: string[];
+    pendingDormant: DormantMove[];
+}
+export declare function newConsolidationResult(dryRun: boolean): ConsolidationResult;
+export {};
+//# sourceMappingURL=run.d.ts.map

package/dist/consolidate/run.js

@@ -0,0 +1,76 @@
+import { openHippoDb, closeHippoDb } from '../db.js';
+import { NO_MERGE_TAGS } from '../shared.js';
+export const REPLAY_COUNT_DEFAULT = 5;
+export function keptAsWritten(entry) {
+    return entry.tags.some((tag) => NO_MERGE_TAGS.has(tag));
+}
+export function isJsonString(value) {
+    return typeof value === 'string';
+}
+// AT1 rejection-guard db handle (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
+// covers BOTH the auto-promote pass (1.4) and the merge
+// pass (3) — both build deterministic content that
+// batchWriteAndDelete writes through the guard's bypass, so both need a
+// producer-side tombstone check before pushing to pendingWrites.
+//
+// T3 fix (2026-08-15 hardening pass, perf hygiene): memoized lazy getter,
+// not an eager open. The handle only serves these two tombstone checks —
+// a sleep with zero promotable sessions and zero merge clusters never
+// reaches either use site, so opening it unconditionally on every
+// non-dry-run sleep paid a db-open cost for nothing. dryRun still never
+// opens (getConsolidateDb short-circuits before touching the handle).
+// consolidateDbOpened (not just a truthy handle check) is the
+// single source of truth for "was this ever opened", so the finally
+// closes it exactly once and never double-opens.
+//
+// AT1 P2 fix (codex, handle-leak restructure): the getter's lifetime must
+// start IMMEDIATELY before the try whose finally closes it, covering every
+// phase that can touch it — not just the merge pass. An exception thrown by
+// auto-promote (1.4), replay (1.5), batch extraction (1.6), the DAG
+// passes (1.7-1.9), or physics (2) would otherwise propagate past an open handle
+// with nothing to close it.
+export function lazyConsolidateDb(hippoRoot, dryRun) {
+    let consolidateDbHandle = null;
+    let consolidateDbOpened = false;
+    const get = () => {
+        if (dryRun)
+            return null;
+        if (!consolidateDbOpened) {
+            consolidateDbHandle = openHippoDb(hippoRoot);
+            consolidateDbOpened = true;
+        }
+        return consolidateDbHandle;
+    };
+    const close = () => {
+        if (consolidateDbHandle)
+            closeHippoDb(consolidateDbHandle);
+    };
+    return { get, close };
+}
+export function newConsolidationResult(dryRun) {
+    return {
+        decayed: 0,
+        removed: 0,
+        dormant: 0,
+        dormantExpired: 0,
+        merged: 0,
+        semanticCreated: 0,
+        replayed: 0,
+        promotedTraces: 0,
+        tracesSkippedMixedScope: 0,
+        extractionCandidates: 0,
+        extracted: 0,
+        dagCandidateClusters: 0,
+        dagSummariesCreated: 0,
+        summariesRebuilt: 0,
+        summariesRebuildFailed: 0,
+        summariesZeroChildSkipped: 0,
+        summariesRebuildRefused: 0,
+        summariesRebuildCapped: false,
+        entityProfilesCreated: 0,
+        dryRun,
+        details: [],
+        physicsSimulated: 0,
+    };
+}
+//# sourceMappingURL=run.js.map

package/dist/consolidate/sleep.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Consolidation engine ("Sleep") for Hippo.
+ *
+ * Steps:
+ * 1. Decay pass  - remove entries below strength threshold
+ * 2. Merge pass  - find episodic entries with high text overlap, create semantic summaries
+ * 3. Stats tracking
+ */
+import { type ConsolidationResult } from './run.js';
+/**
+ * Run a full consolidation pass.
+ */
+export declare function consolidate(hippoRoot: string, options?: {
+    dryRun?: boolean;
+    now?: Date;
+    fetcher?: typeof fetch;
+}): Promise<ConsolidationResult>;
+//# sourceMappingURL=sleep.d.ts.map

package/dist/consolidate/sleep.js

@@ -0,0 +1,209 @@
+/**
+ * Consolidation engine ("Sleep") for Hippo.
+ *
+ * Steps:
+ * 1. Decay pass  - remove entries below strength threshold
+ * 2. Merge pass  - find episodic entries with high text overlap, create semantic summaries
+ * 3. Stats tracking
+ */
+import { evalNow } from '../ablation.js';
+import { canAutoDelete } from '../memory.js';
+import { loadAllEntries } from '../store/entry-reads.js';
+import { batchWriteAndDelete, memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { appendConsolidationRun, loadSessionDecayContext, incrementSleepCount } from '../store/index-and-stats.js';
+import { replaceDetectedConflicts } from '../store/conflicts.js';
+import { openHippoDb, closeHippoDb } from '../db.js';
+import { countExpiredDormant, purgeExpiredDormant } from '../dormant.js';
+import { loadConfig } from '../config.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
+import { migrateDefaultHalfLife, LEGACY_TYPED_HALF_LIFE } from '../half-life-migration.js';
+import { log } from '../log.js';
+import { decayPass } from './decay.js';
+import { retireHeldTexts, mergePass } from './merge.js';
+import { detectConflicts } from './conflicts.js';
+import { lazyConsolidateDb, newConsolidationResult } from './run.js';
+import { promoteSessionTraces, replayPass } from './traces.js';
+import { llmPasses } from './llm-passes.js';
+import { physicsPass } from './physics-pass.js';
+/**
+ * Run a full consolidation pass.
+ */
+export async function consolidate(hippoRoot, options = {}) {
+    const now = options.now ?? evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
+    const dryRun = options.dryRun ?? false;
+    const result = newConsolidationResult(dryRun);
+    const halfLife = migrateHalfLives(hippoRoot, dryRun, result);
+    // L9: host-wide by design. Consolidation runs across all tenants in one
+    // pass — per-tenant filtering would create N consolidation runs per host
+    // with no cross-tenant dedup. The api.sleep audit row tags this with the
+    // admin synthetic actor; see api.ts:2050 for the rationale.
+    const all = loadAllEntries(hippoRoot);
+    if (dryRun)
+        for (const e of all)
+            e.half_life_days = halfLife.halfLives.get(e.id) ?? e.half_life_days;
+    const backingObjects = memoriesBackingObjects(hippoRoot);
+    // Retirable: auto-deletable (never pinned, raw or kept for good) and not backing a first-class object.
+    const retirable = (entry) => canAutoDelete(entry) && !backingObjects.has(entry.id);
+    const snapshot = new Map(structuredClone(all).map((e) => [e.id, e]));
+    // Load decay options from config + session context
+    const config = loadConfig(hippoRoot);
+    const sessionCtx = loadSessionDecayContext(hippoRoot);
+    const decayOpts = {
+        decayBasis: config.decayBasis,
+        avgSessionIntervalDays: sessionCtx.avgSessionIntervalDays,
+        sleepCount: sessionCtx.sleepCount,
+    };
+    const consolidateDb = lazyConsolidateDb(hippoRoot, dryRun);
+    const run = {
+        hippoRoot, now, dryRun, config, decayOpts, result, all, retirable,
+        getConsolidateDb: consolidateDb.get,
+        survivors: [],
+        // Collect all writes/deletes and batch them at the end
+        pendingWrites: [],
+        pendingDeletes: [],
+        pendingDormant: [],
+    };
+    const decay = decayPass(run);
+    let mergesSkippedRejected = 0;
+    try {
+        promoteSessionTraces(run);
+        replayPass(run);
+        await llmPasses(run, options.fetcher);
+        physicsPass(run);
+        retireHeldTexts(run);
+        mergesSkippedRejected = mergePass(run);
+    }
+    finally {
+        consolidateDb.close();
+    }
+    if (mergesSkippedRejected > 0) {
+        log.warn(`consolidate: skipped ${mergesSkippedRejected} merge(s) whose content matches a rejected value`);
+    }
+    flushPending(run, snapshot);
+    expireDormant(run);
+    if (!dryRun)
+        logRun(run, decay);
+    return result;
+}
+// A changed default half-life moves memories still on the old base first,
+// so this pass decays them at the new one (src/half-life-migration.ts).
+function migrateHalfLives(hippoRoot, dryRun, result) {
+    const halfLife = migrateDefaultHalfLife(hippoRoot, loadConfig(hippoRoot).defaultHalfLifeDays, { dryRun });
+    if (halfLife.rescaled > 0) {
+        result.details.push(`  ⏳ ${dryRun ? 'would move' : 'moved'} ${halfLife.rescaled} memories from the ${halfLife.from}-day to the ${halfLife.to}-day half-life`);
+    }
+    if (halfLife.typed > 0) {
+        result.details.push(`  ⏳ ${dryRun ? 'would move' : 'moved'} ${halfLife.typed} memories of decisions, incidents and other objects from the ${LEGACY_TYPED_HALF_LIFE}-day to the ${halfLife.to}-day half-life`);
+    }
+    return halfLife;
+}
+function flushPending(run, snapshot) {
+    const { result, pendingDeletes, pendingDormant } = run;
+    result.removedIds = pendingDeletes;
+    // One transaction; the snapshot keeps what the DAG passes and other writers changed while sleep ran.
+    // Dormant moves ride in the same transaction (src/dormant.ts).
+    if (run.dryRun)
+        return;
+    const left = new Set(batchWriteAndDelete(run.hippoRoot, run.pendingWrites, pendingDeletes, { snapshot, dormant: pendingDormant }));
+    for (const id of [...pendingDeletes, ...pendingDormant.map((m) => m.entry.id)]) {
+        if (!left.has(id))
+            result.details.push(`  ↩  ${id} not removed: pinned or already gone before sleep saved`);
+    }
+    result.removedIds = pendingDeletes.filter((id) => left.has(id));
+    result.removed = result.removedIds.length;
+    result.dormant = pendingDormant.filter((m) => left.has(m.entry.id)).length;
+}
+// Dormant retention: a dormant memory nobody restored within
+// dormant.retentionDays is deleted for good (0 keeps them forever). Runs
+// even when dormant.enabled is off, so turning it off still ages out what
+// earlier sleeps kept.
+function expireDormant(run) {
+    const { config, result, dryRun } = run;
+    if (!(config.dormant.retentionDays > 0))
+        return;
+    const cutoff = new Date(run.now.getTime() - config.dormant.retentionDays * 24 * 60 * 60 * 1000).toISOString();
+    const db = openHippoDb(run.hippoRoot);
+    try {
+        result.dormantExpired = dryRun ? countExpiredDormant(db, cutoff) : purgeExpiredDormant(db, cutoff);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    if (result.dormantExpired > 0) {
+        result.details.push(`  ⌛ ${dryRun ? 'would expire' : 'expired'} ${result.dormantExpired} dormant memor${result.dormantExpired === 1 ? 'y' : 'ies'} older than ${config.dormant.retentionDays} days`);
+    }
+}
+// -------------------------------------------------------------------------
+// 4. Log run
+// -------------------------------------------------------------------------
+function logRun(run, decay) {
+    const { hippoRoot, now, result } = run;
+    const detectedConflicts = detectConflicts(run.survivors, now, run.decayOpts, decay.rescuedIds);
+    replaceDetectedConflicts(hippoRoot, detectedConflicts, now.toISOString());
+    if (detectedConflicts.length > 0) {
+        result.details.push(`  ⚠️ detected ${detectedConflicts.length} memory conflict${detectedConflicts.length === 1 ? '' : 's'}`);
+    }
+    appendConsolidationRun(hippoRoot, {
+        timestamp: now.toISOString(),
+        decayed: result.decayed,
+        merged: result.merged,
+        removed: result.removed,
+    });
+    incrementSleepCount(hippoRoot);
+    if (decay.rescuedEntries.length > 0)
+        auditRescues(run, decay);
+}
+// One audit row per rescue (attributability, D1). Written here, AFTER
+// batchWriteAndDelete has committed this cycle's writes/deletes
+// (and after conflict detection + run logging), not inline in the decay
+// pass — same durability posture as api.ts's top-level 'consolidate'
+// summary audit row (written only once the whole sleep has completed).
+// Writing it earlier would assert rescues for a cycle whose effects
+// never landed if a later phase threw. Real writes only — dry-run
+// previews the decision (details line above) but persists nothing.
+function auditRescues(run, { rescuedEntries, rankById }) {
+    const { result } = run;
+    try {
+        const auditDb = openHippoDb(run.hippoRoot);
+        try {
+            // Review-round F5: per-row try/catch, not one try/catch around the
+            // whole loop — a single failed appendAuditEvent must not silently
+            // drop every remaining row. Mirrors the physics pass's
+            // skipped-warning precedent: count losses, keep
+            // the overall fail-soft posture, tell the operator via details.
+            let auditFailures = 0;
+            for (const entry of rescuedEntries) {
+                try {
+                    const rank = rankById.get(entry.id);
+                    appendAuditEvent(auditDb, {
+                        tenantId: entry.tenantId,
+                        actor: 'sleep',
+                        op: 'mv_rescue',
+                        targetId: entry.id,
+                        metadata: rank
+                            ? { rank: rank.rank, totalNonPinned: rank.totalNonPinned, keepN: rank.keepN, score: rank.score }
+                            : {},
+                    });
+                }
+                catch (error) {
+                    auditFailures++;
+                    reportAuditWriteFailure('mv_rescue', String(error), entry.id);
+                }
+            }
+            if (auditFailures > 0) {
+                result.details.push(`  ⚠️ memory-value: ${auditFailures} mv_rescue audit row${auditFailures === 1 ? '' : 's'} ` +
+                    `failed to write (the rescue itself still landed)`);
+            }
+        }
+        finally {
+            closeHippoDb(auditDb);
+        }
+    }
+    catch {
+        // openHippoDb/closeHippoDb-level failure: audit must never crash a
+        // mutation (mirrors store.ts's audit() posture).
+        result.details.push(`  ⚠️ memory-value: mv_rescue audit unavailable this cycle ` +
+            `(${rescuedEntries.length} rescue${rescuedEntries.length === 1 ? '' : 's'} not audited)`);
+    }
+}
+//# sourceMappingURL=sleep.js.map

package/dist/consolidate/traces.d.ts

@@ -0,0 +1,4 @@
+import { type SleepRun } from './run.js';
+export declare function promoteSessionTraces(run: SleepRun): void;
+export declare function replayPass(run: SleepRun): void;
+//# sourceMappingURL=traces.d.ts.map

package/dist/consolidate/traces.js

@@ -0,0 +1,178 @@
+import { isRecallBoostAblated } from '../ablation.js';
+import { Layer, createMemory, markRetrieved } from '../memory.js';
+import { findPromotableSessions, traceExistsForSession, listSessionEvents } from '../store/sessions.js';
+import { rejectionDigest, findRejectedValue } from '../rejection.js';
+import { sampleForReplay } from '../replay.js';
+import { renderTraceContent } from '../trace.js';
+import { resolveTenantId } from '../tenant.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
+import { commonDerivationScope } from '../recall-scope.js';
+import { log } from '../log.js';
+import { REPLAY_COUNT_DEFAULT, isJsonString } from './run.js';
+// -------------------------------------------------------------------------
+// 1.4. Auto-promote complete sessions to traces
+// -------------------------------------------------------------------------
+//
+// For each session within the configured window that has a `session_complete`
+// event and no existing trace (idempotency via the source_session_id column),
+// render the action sequence as markdown and persist a Layer.Trace memory.
+// Traces inherit decay, search, replay, and physics from the base MemoryEntry.
+export function promoteSessionTraces(run) {
+    const { result } = run;
+    if (run.dryRun || run.config.autoTraceCapture === false)
+        return;
+    let tracesSkippedRejected = 0;
+    const windowDays = run.config.autoTraceWindowDays ?? 7;
+    const sinceMs = run.now.getTime() - windowDays * 24 * 60 * 60 * 1000;
+    // Auto-trace currently runs in a single-tenant context (the env-resolved
+    // tenant for this process). Multi-tenant deployments that want
+    // consolidation across all tenants need a per-tenant loop layered on top
+    // of this — tracked in docs/plans/2026-05-02-continuity-tables-tenant-scope.md.
+    const consolidationTenant = resolveTenantId({});
+    const promotable = findPromotableSessions(run.hippoRoot, consolidationTenant, sinceMs);
+    for (const session of promotable) {
+        const built = sessionTrace(run, consolidationTenant, session.session_id);
+        if (!built)
+            continue;
+        const { trace, outcome } = built;
+        if (traceRejected(run, trace, session.session_id)) {
+            tracesSkippedRejected++;
+            continue;
+        }
+        run.pendingWrites.push(trace);
+        run.survivors.push(trace);
+        result.promotedTraces++;
+        result.details.push(`  🧬 promoted trace ${trace.id} from session ${session.session_id} (${outcome})`);
+    }
+    if (result.promotedTraces > 0) {
+        result.details.push(`  🧬 promoted ${result.promotedTraces} trace${result.promotedTraces === 1 ? '' : 's'} from completed session${result.promotedTraces === 1 ? '' : 's'}`);
+    }
+    if (tracesSkippedRejected > 0) {
+        log.warn(`consolidate: skipped ${tracesSkippedRejected} auto-promoted trace(s) whose content matches a rejected value`);
+    }
+}
+/** The trace a completed session renders to, or null when it already has one or cannot be promoted. */
+function sessionTrace(run, consolidationTenant, sessionId) {
+    // Idempotency: skip if a trace for this session already exists.
+    if (traceExistsForSession(run.hippoRoot, consolidationTenant, sessionId))
+        return null;
+    const events = listSessionEvents(run.hippoRoot, consolidationTenant, {
+        session_id: sessionId,
+        limit: 1000,
+    });
+    // T7: a mixed-scope session would otherwise leak into one trace.
+    const sessionScope = commonDerivationScope(events.map((e) => e.scope));
+    if (!sessionScope.ok) {
+        run.result.tracesSkippedMixedScope++;
+        run.result.details.push(`  ⏭  skipped session ${sessionId}: events span mixed scopes`);
+        return null;
+    }
+    const completeEvent = events.find((e) => e.event_type === 'session_complete');
+    if (!completeEvent)
+        return null; // defence-in-depth; findPromotableSessions filters already.
+    const outcomeRaw = completeEvent.content;
+    if (outcomeRaw !== 'success' && outcomeRaw !== 'failure' && outcomeRaw !== 'partial') {
+        // Malformed terminal event — skip rather than crash the whole sleep.
+        return null;
+    }
+    const outcome = outcomeRaw;
+    const steps = events
+        .filter((e) => e.event_type !== 'session_complete')
+        .map((e) => ({ action: e.content, observation: '' }));
+    // SAFETY: session event metadata is a free-form Record<string, unknown>
+    // bag; summary is optional and is only trusted once isJsonString below
+    // confirms it is actually a string.
+    const summaryValue = completeEvent.metadata.summary;
+    const summary = isJsonString(summaryValue) ? summaryValue : '(untitled)';
+    const trace = createMemory(renderTraceContent({ task: summary, steps, outcome }), {
+        layer: Layer.Trace,
+        trace_outcome: outcome,
+        source_session_id: sessionId,
+        tags: ['auto-promoted'],
+        source: 'auto-promote',
+        scope: sessionScope.scope,
+        // T1 fix (2026-08-15 hardening pass): stamp the trace into the SAME
+        // tenant the traceExistsForSession idempotency check (above) runs
+        // under. Before
+        // this, createMemory omitted tenantId and the trace always landed
+        // 'default' (memory.ts:535) while the idempotency check ran under
+        // consolidationTenant — for any non-default tenant that check never
+        // hit, and the trace regenerated every sleep.
+        tenantId: consolidationTenant,
+        baseHalfLifeDays: run.config.defaultHalfLifeDays,
+    });
+    return { trace, outcome };
+}
+// AT1 (same producer-side pattern as the merge pass below): traceExistsForSession
+// only sees rows CURRENTLY in the store — once a rejected trace is
+// removed, that idempotency check no longer blocks regeneration, and
+// this write would otherwise reach batchWriteAndDelete's guard bypass
+// unchecked, resurrecting it every sleep. Check under THE ENTRY'S OWN
+// stamped tenantId (read off `trace` after createMemory — never guess
+// the tenant) + the built content's digest. A hit skips the push
+// entirely: not counted as promoted, not added to survivors.
+function traceRejected(run, trace, sessionId) {
+    const consolidateDb = run.getConsolidateDb();
+    if (!consolidateDb)
+        return false;
+    const traceDigest = rejectionDigest(trace.content);
+    const tombstone = findRejectedValue(consolidateDb, trace.tenantId, traceDigest);
+    if (!tombstone)
+        return false;
+    try {
+        appendAuditEvent(consolidateDb, {
+            tenantId: trace.tenantId,
+            actor: 'sleep',
+            op: 'reject_refusal',
+            metadata: {
+                digest: traceDigest,
+                reason: tombstone.reason,
+                sourceSessionId: sessionId,
+            },
+        });
+    }
+    catch (error) {
+        reportAuditWriteFailure('reject_refusal', String(error));
+    }
+    return true;
+}
+// -------------------------------------------------------------------------
+// 1.5. Replay pass — rehearse high-value survivors
+// -------------------------------------------------------------------------
+//
+// Biologically-inspired counterpart to hippocampal replay during slow-wave
+// sleep: sample N memories weighted by outcome + valence + under-rehearsal
+// + idle time, then apply the same retrieval-strengthening `markRetrieved`
+// applies to real queries. Distinct from decay (removal), physics (motion),
+// and merge (compression) — this is the "rehearse the important stuff so
+// it doesn't fade" pass.
+export function replayPass(run) {
+    const { survivors, now } = run;
+    const replayCount = run.config.replay?.count ?? REPLAY_COUNT_DEFAULT;
+    // EVAL-ONLY ablation (see ablation.ts): replay rehearsal IS recall
+    // strengthening (same markRetrieved dynamics), so the strengthen-off arm
+    // silences the whole pass - markRetrieved would return unmutated entries
+    // and persisting them anyway would still refresh updated_at / mirrors.
+    if (!(replayCount > 0 && survivors.length > 0 && !isRecallBoostAblated()))
+        return;
+    const seed = Math.floor(now.getTime() / 1000) & 0xffffffff;
+    const picked = sampleForReplay(survivors, replayCount, now, seed);
+    if (picked.length === 0)
+        return;
+    const rehearsed = markRetrieved(picked, now);
+    const rehearsedById = new Map(rehearsed.map((e) => [e.id, e]));
+    // Update survivors in place so downstream passes see rehearsed state.
+    for (let i = 0; i < survivors.length; i++) {
+        const replacement = rehearsedById.get(survivors[i].id);
+        if (replacement)
+            survivors[i] = replacement;
+    }
+    run.result.replayed = rehearsed.length;
+    run.result.details.push(`  💭 replayed ${rehearsed.length} memor${rehearsed.length === 1 ? 'y' : 'ies'}: ` +
+        rehearsed.map((e) => e.id).join(', '));
+    if (!run.dryRun) {
+        for (const r of rehearsed)
+            run.pendingWrites.push(r);
+    }
+}
+//# sourceMappingURL=traces.js.map

package/dist/context-auto.js

@@ -1,13 +1,13 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 const SKIPPED_PATH_TERMS = ['src', 'dist', 'test', 'tests', 'node_modules', 'index'];
+// stderr is dropped because git's warnings (line-ending notices, for one) would otherwise become query terms.
+function readGit(args) {
+    return execFileSync('git', args, { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim();
+}
 /** A context query from the cwd's git state ('' means `getContext` lists by strength); kept out of the api layer, which never shells out. */
 export function autoDetectContext() {
     try {
-        const diff = execSync('git diff --name-only HEAD 2>&1', {
-            encoding: 'utf8',
-            timeout: 3000,
-            windowsHide: true,
-        }).trim();
+        const diff = readGit(['diff', '--name-only', 'HEAD']);
         if (diff) {
             const terms = diff
                 .split('\n')
@@ -17,11 +17,7 @@ export function autoDetectContext() {
             if (terms.length > 0)
                 return terms.join(' ');
         }
-        const branch = execSync('git branch --show-current 2>&1', {
-            encoding: 'utf8',
-            timeout: 3000,
-            windowsHide: true,
-        }).trim();
+        const branch = readGit(['branch', '--show-current']);
         if (branch && branch !== 'main' && branch !== 'master') {
             return branch.replace(/[-_/]/g, ' ');
         }

package/dist/context-render.d.ts

@@ -1,6 +1,6 @@
 import { type MemoryEntry } from './memory.js';
 import { type SessionHandoff } from './handoff.js';
-import type { SessionEvent, TaskSnapshot } from './store.js';
+import type { SessionEvent, TaskSnapshot } from './store/rows.js';
 import type { AssembleCost, AssembleResult, AssembledContextItem, ContextCost, ContextResultEntry, DrillDownChild, DrillDownCost, DrillDownResult } from './api.js';
 export declare function snapshotText(s: TaskSnapshot): string;
 export declare function handoffText(h: SessionHandoff): string;

package/dist/context-render.js

@@ -1,7 +1,7 @@
 // The strings a context block prints. The budget prices these same strings, so selection and print cannot drift.
 import { calculateStrength, confidenceFacets, confidenceLabel } from './memory.js';
 import { evalNow } from './ablation.js';
-import { estimateTokens } from './search.js';
+import { estimateTokens } from './token-ledger.js';
 import { renderAmbientSummary } from './ambient.js';
 import { formatHandoffEvidenceLine } from './handoff.js';
 export function snapshotText(s) {

package/dist/customer-notes.d.ts

@@ -19,6 +19,7 @@
  *
  * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
  */
+import { type KeysetPosition } from './keyset.js';
 export type NoteStatus = 'active' | 'superseded' | 'closed';
 export declare const VALID_NOTE_STATES: ReadonlySet<NoteStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). note is a body, so a larger cap
@@ -61,6 +62,8 @@ export interface ListCustomerNotesOpts {
     /** Filter to a single customer. */
     customer?: string;
     limit?: number;
+    /** Resume after this row: the position the previous page ended on. */
+    after?: KeysetPosition;
 }
 /**
  * Create a customer_note (or a new version that supersedes an existing one). Writes

package/dist/customer-notes.js

@@ -21,12 +21,13 @@
  */
 import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
 import { assertTenantId } from './tenant.js';
-import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
+import { markGraphDirty, removeGraphEntitiesForObject } from './graph/write.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
+import { keysetAfter } from './keyset.js';
 export const VALID_NOTE_STATES = new Set([
     'active',
     'superseded',
@@ -284,6 +285,7 @@ export function loadCustomerNoteById(hippoRoot, tenantId, id) {
 export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadCustomerNotes', tenantId);
     const limit = opts.limit ?? 100;
+    const after = keysetAfter('created_at', 'id', opts.after);
     if (opts.status && !VALID_NOTE_STATES.has(opts.status)) {
         throw new BadRequestError(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
     }
@@ -299,13 +301,13 @@ export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
             clauses.push('customer = ?');
             params.push(opts.customer);
         }
-        params.push(limit);
+        params.push(...after.params, limit);
         // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns
         // regardless of the dynamic WHERE clause built above; .all() returns rows
         // in that shape.
         const rows = db.prepare(`
       SELECT ${NOTE_COLS} FROM customer_notes
-      WHERE ${clauses.join(' AND ')}
+      WHERE ${clauses.join(' AND ')}${after.sql}
       ORDER BY created_at DESC, id DESC
       LIMIT ?
     `).all(...params);