hippo-memory 1.61.0 → 1.63.0

package/dist/compaction-record.js

@@ -7,7 +7,7 @@ import { loadConfig } from './config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb } from './db.js';
 import { gatedWrite } from './gated-write.js';
 import { COMPACTION_MEMORY_TAG, COMPACTION_SOURCE_PREFIX, Layer, createMemory, generateId } from './memory.js';
-import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
+import { isGlobalStoreRoot, originInSql, projectId, projectNames, resolveProjectIdentity } from './project-identity.js';
 import { maskEmails, redactSecretsStrict } from './secret-detect.js';
 import { strengthenRetrievedOn, writeEntryMirrors } from './store/entry-writes.js';
 import { isRecallBoostAblated } from './ablation.js';
@@ -30,11 +30,19 @@ const CLAIMED_SUFFIX = '.claimed';
 /** The marker redactSecretsStrict writes; an item holding it was a secret before it was stored. */
 const REDACTED = '[REDACTED]';
 /** Where the session ran: rows written through the global store keep the project the session was in. */
-export function compactionOrigin(hippoRoot, cwd) {
+function compactionProject(hippoRoot, cwd) {
     if (!isGlobalStoreRoot(hippoRoot))
-        return deriveOriginProject(path.dirname(hippoRoot));
+        return resolveProjectIdentity(path.dirname(hippoRoot));
     // No cwd means user-global, as stampOriginProject gives the global store; undefined would fall back to the hook's own cwd.
-    return cwd === null ? '' : deriveOriginProject(cwd);
+    return cwd === null ? '' : resolveProjectIdentity(cwd);
+}
+function compactionOrigin(hippoRoot, cwd) {
+    return projectId(compactionProject(hippoRoot, cwd));
+}
+/** The names a record's held rows may carry: its origin, plus the folder name rows saved before project ids used. */
+function heldOrigins(hippoRoot, cwd, originProject) {
+    const names = projectNames(compactionProject(hippoRoot, cwd));
+    return names.includes(originProject) ? names : [originProject];
 }
 function scrub(text) {
     return maskEmails(redactSecretsStrict(text));
@@ -158,12 +166,76 @@ function restates(item, held) {
     return next === item.length;
 }
 /** Live rows of one tenant and origin that default recall shows: a compaction often restates what an earlier one, or the user, already saved. */
-function heldRows(db, tenantId, originProject) {
+function heldRows(db, tenantId, origins) {
     // SAFETY: the SELECT names the id, source_session_id and content columns.
-    const rows = db.prepare(`SELECT id, source_session_id, content FROM memories WHERE tenant_id = ? AND origin_project = ? AND superseded_by IS NULL AND kind != 'raw'
-       AND (scope IS NULL OR (scope != 'unknown:legacy' AND scope NOT LIKE '%:private:%'))`).all(tenantId, originProject);
+    const rows = db.prepare(`SELECT id, source_session_id, content FROM memories WHERE tenant_id = ? AND ${originInSql(origins)} AND superseded_by IS NULL AND kind != 'raw'
+       AND (scope IS NULL OR (scope != 'unknown:legacy' AND scope NOT LIKE '%:private:%'))`).all(tenantId, ...origins);
     return rows.map((r) => ({ id: r.id, sessionId: r.source_session_id, words: words(r.content) }));
 }
+function compactionEntry(text, ctx, baseHalfLifeDays) {
+    return {
+        ...createMemory(text, {
+            layer: Layer.Episodic,
+            tags: [COMPACTION_MEMORY_TAG],
+            source: `${COMPACTION_SOURCE_PREFIX}${ctx.sessionId}`,
+            confidence: 'observed',
+            kind: 'distilled',
+            source_session_id: ctx.sessionId,
+            tenantId: ctx.tenantId,
+            baseHalfLifeDays,
+        }),
+        origin_project: ctx.originProject,
+    };
+}
+/** Runs inside saveItems' transaction: restatements of held rows are counted, the rest go through the write gate. */
+function writeItemRows(db, hippoRoot, ctx, rows, baseHalfLifeDays) {
+    const out = { written: [], repeats: 0, refused: 0, restated: [] };
+    const held = heldRows(db, ctx.tenantId, heldOrigins(hippoRoot, ctx.cwd, ctx.originProject));
+    const restated = new Set();
+    for (const text of rows) {
+        const itemWords = words(text);
+        const match = held.find((h) => restates(itemWords, h.words));
+        if (match) {
+            out.repeats++;
+            if (match.id !== null && match.sessionId !== ctx.sessionId)
+                restated.add(match.id);
+            continue;
+        }
+        // createMemory throws below 3 chars, which would sink the whole transaction.
+        if (text.trim().length < 3) {
+            out.refused++;
+            continue;
+        }
+        const entry = compactionEntry(text, ctx, baseHalfLifeDays);
+        if (gatedWrite(db, hippoRoot, entry, { actor: 'post-compact' }) === 'written') {
+            out.written.push(entry);
+            held.push({ id: null, sessionId: ctx.sessionId, words: itemWords });
+        }
+        else {
+            out.refused++;
+        }
+    }
+    out.restated = [...restated];
+    return out;
+}
+/** After commit: report skips, mirror the new rows, bump the counter. */
+function finishItemWrites(hippoRoot, writes, log) {
+    if (writes.repeats > 0)
+        log(`skipped ${writes.repeats} item(s) the store already holds`);
+    if (writes.refused > 0)
+        log(`skipped ${writes.refused} item(s) the write gate refused`);
+    for (const entry of writes.written)
+        writeEntryMirrors(hippoRoot, entry);
+    if (writes.written.length > 0) {
+        try {
+            updateStats(hippoRoot, { remembered: writes.written.length });
+        }
+        catch (err) {
+            // The rows are committed; a counter that could not be bumped must not turn that into a failed step.
+            log(`remembered counter not updated: ${errorMessage(err)}`);
+        }
+    }
+}
 /** Items that become rows, then the record `done`, in one transaction so two sessions cannot both insert one text. Mirrors after commit. */
 export function saveItems(db, hippoRoot, ctx, log) {
     const usable = ctx.items.filter((item) => !item.includes(REDACTED));
@@ -175,9 +247,7 @@ export function saveItems(db, hippoRoot, ctx, log) {
     if (capped > 0)
         log(`capped: ${capped} more kept in the record only`);
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
-    const written = [];
-    let repeats = 0;
-    let refused = 0;
+    let writes;
     db.exec('BEGIN IMMEDIATE');
     try {
         if (ctx.recordId !== null) {
@@ -190,47 +260,11 @@ export function saveItems(db, hippoRoot, ctx, log) {
                 return current?.items_written ?? 0;
             }
         }
-        const held = heldRows(db, ctx.tenantId, ctx.originProject);
-        const restated = new Set();
-        for (const text of rows) {
-            const itemWords = words(text);
-            const match = held.find((h) => restates(itemWords, h.words));
-            if (match) {
-                repeats++;
-                if (match.id !== null && match.sessionId !== ctx.sessionId)
-                    restated.add(match.id);
-                continue;
-            }
-            // createMemory throws below 3 chars, which would sink the whole transaction.
-            if (text.trim().length < 3) {
-                refused++;
-                continue;
-            }
-            const entry = {
-                ...createMemory(text, {
-                    layer: Layer.Episodic,
-                    tags: [COMPACTION_MEMORY_TAG],
-                    source: `${COMPACTION_SOURCE_PREFIX}${ctx.sessionId}`,
-                    confidence: 'observed',
-                    kind: 'distilled',
-                    source_session_id: ctx.sessionId,
-                    tenantId: ctx.tenantId,
-                    baseHalfLifeDays,
-                }),
-                origin_project: ctx.originProject,
-            };
-            if (gatedWrite(db, hippoRoot, entry, { actor: 'post-compact' }) === 'written') {
-                written.push(entry);
-                held.push({ id: null, sessionId: ctx.sessionId, words: itemWords });
-            }
-            else {
-                refused++;
-            }
-        }
+        writes = writeItemRows(db, hippoRoot, ctx, rows, baseHalfLifeDays);
         // Said again by another session is the same signal as being recalled; the same session carrying it forward is not.
-        strengthenRetrievedOn(db, [...restated], { tenantId: ctx.tenantId, recallBoostAblated: isRecallBoostAblated() });
+        strengthenRetrievedOn(db, writes.restated, { tenantId: ctx.tenantId, recallBoostAblated: isRecallBoostAblated() });
         if (ctx.recordId !== null) {
-            db.prepare(`UPDATE compactions SET items_written = ?, status = 'done' WHERE tenant_id = ? AND id = ?`).run(written.length, ctx.tenantId, ctx.recordId);
+            db.prepare(`UPDATE compactions SET items_written = ?, status = 'done' WHERE tenant_id = ? AND id = ?`).run(writes.written.length, ctx.tenantId, ctx.recordId);
         }
         db.exec('COMMIT');
     }
@@ -241,22 +275,8 @@ export function saveItems(db, hippoRoot, ctx, log) {
         catch { /* already rolled back; keep the original error */ }
         throw err;
     }
-    if (repeats > 0)
-        log(`skipped ${repeats} item(s) the store already holds`);
-    if (refused > 0)
-        log(`skipped ${refused} item(s) the write gate refused`);
-    for (const entry of written)
-        writeEntryMirrors(hippoRoot, entry);
-    if (written.length > 0) {
-        try {
-            updateStats(hippoRoot, { remembered: written.length });
-        }
-        catch (err) {
-            // The rows are committed; a counter that could not be bumped must not turn that into a failed step.
-            log(`remembered counter not updated: ${errorMessage(err)}`);
-        }
-    }
-    return written.length;
+    finishItemWrites(hippoRoot, writes, log);
+    return writes.written.length;
 }
 /** null when the text is not a PostCompact payload naming a session. */
 export function parsePostCompactPayload(stdinText) {
@@ -320,6 +340,7 @@ export function saveCompaction(hippoRoot, payload, log) {
                 recordId: record?.id ?? null,
                 sessionId: payload.sessionId,
                 originProject: record?.originProject ?? compactionOrigin(hippoRoot, payload.cwd),
+                cwd: payload.cwd,
                 items: text.items,
             }, log);
         }
@@ -494,7 +515,7 @@ function importSpool(db, hippoRoot, tenantId, log, deadline) {
             // The record holds the items now, so the file is done even if the write below fails.
             fs.rmSync(claimed, { force: true });
             removed = true;
-            saveItems(db, hippoRoot, { tenantId: spooled.tenantId, recordId: record.id, sessionId: record.sessionId, originProject: record.originProject, items: record.items }, log);
+            saveItems(db, hippoRoot, { tenantId: spooled.tenantId, recordId: record.id, sessionId: record.sessionId, originProject: record.originProject, cwd: record.cwd, items: record.items }, log);
             finished++;
         }
         catch (err) {
@@ -515,7 +536,7 @@ export function replayCompactions(db, hippoRoot, log, deadline = Number.POSITIVE
         if (Date.now() > deadline)
             break;
         try {
-            saveItems(db, hippoRoot, { tenantId, recordId: record.id, sessionId: record.sessionId, originProject: record.originProject, items: record.items }, log);
+            saveItems(db, hippoRoot, { tenantId, recordId: record.id, sessionId: record.sessionId, originProject: record.originProject, cwd: record.cwd, items: record.items }, log);
             finished++;
         }
         catch (err) {
@@ -549,7 +570,7 @@ export function replayCompactions(db, hippoRoot, log, deadline = Number.POSITIVE
                 log(`${record.id} was filled by another process`);
                 continue;
             }
-            saveItems(db, hippoRoot, { tenantId, recordId: record.id, sessionId: record.sessionId, originProject: record.originProject, items: text.items }, log);
+            saveItems(db, hippoRoot, { tenantId, recordId: record.id, sessionId: record.sessionId, originProject: record.originProject, cwd: record.cwd, items: text.items }, log);
             finished++;
         }
         catch (err) {

package/dist/compare.d.ts

@@ -6,8 +6,7 @@
  * multihop.ts, rerankers/*). Every comparator here takes a structural param
  * type instead of an imported one, on purpose — a type-only import back to
  * search.ts would still create the search.ts <-> physics.ts ESM import
- * cycle this module exists to avoid (r2 critic HIGH,
- * docs/plans/2026-07-09-recall-determinism.md T2).
+ * cycle this module exists to avoid.
  *
  * Mirrors the deliberate-determinism comment style already established in
  * graph-stream.ts:88, :165-168, :233-236 — a sort with a documented,
@@ -32,11 +31,9 @@ export interface EntryIdentity {
  * independently-created stores (different directory name, different insert
  * order of everything else on disk) sorts identically. The metadata keys make
  * byte-identical twins order by what they carry instead of by `id`
- * (`crypto.randomUUID()`), which is per-instance random: before v1.38.1 the
- * dedupe survivor of two twins that differed only in tags or source was
- * whichever id sorted first, and a semantic/episodic pair always kept the
- * episodic copy because `mem_` sorts before `sem_`. `id` stays the terminal
- * key so the order is total within one store.
+ * (`crypto.randomUUID()`), which is per-instance random and would make the
+ * dedupe survivor arbitrary. `id` stays the terminal key so the order is
+ * total within one store.
  *
  * Layer rank puts semantic first: semantic rows are consolidation output, so
  * keeping that copy preserves the promotion instead of demoting the memory.
@@ -47,8 +44,8 @@ export interface EntryIdentity {
  * Plain `<`/`>`, NOT `localeCompare`: `localeCompare` is locale- and
  * ICU-version-dependent (a determinism leak in its own right) and needlessly
  * slow for a tiebreak that only needs a total order. The metadata keys are
- * only computed on a content tie, which is rare post-T1 (path-tag embedding
- * fix), so the per-compare Set/sort cost never lands on the hot path.
+ * only computed on a content tie, which is rare, so the per-compare Set/sort
+ * cost never lands on the hot path.
  */
 export declare function compareEntryIdentity(a: EntryIdentity, b: EntryIdentity): number;
 /** Minimal shape for score-primary sort sites (SearchResult and friends
@@ -72,13 +69,11 @@ export declare function compareScoredResults(a: ScoredEntryLike, b: ScoredEntryL
  *
  * `ScoredPhysicsResult` (physics.ts) carries `{ memoryId, baseScore,
  * clusterAmplification, finalScore }` -- NO `entry`/`content` in scope at
- * that layer, so `compareEntryIdentity` cannot apply directly (plan T2
- * shape (c)). With only the default memoryId key this is PER-INSTANCE-ONLY
- * determinism; callers that need CROSS-INGEST stability supply `tieKeyOf`
- * mapping the result to its memory CONTENT (codex review finding: the
- * baseScore tie order selects the cluster_top_k amplification set, which
- * MUTATES scores before the downstream content-aware merge sort runs -- so
- * the tie key must be content-stable at THIS layer, not just downstream).
+ * that layer, so `compareEntryIdentity` cannot apply directly. With only the
+ * default memoryId key this is PER-INSTANCE-ONLY determinism; callers that need
+ * CROSS-INGEST stability supply `tieKeyOf` mapping the result to its memory
+ * CONTENT, because the baseScore tie order selects the cluster_top_k
+ * amplification set, which MUTATES scores before the content-aware merge sort.
  *
  * A factory (not a fixed-field comparator) because physics.ts re-sorts the
  * same result array by two different score fields in sequence (`baseScore`

package/dist/compare.js

@@ -6,8 +6,7 @@
  * multihop.ts, rerankers/*). Every comparator here takes a structural param
  * type instead of an imported one, on purpose — a type-only import back to
  * search.ts would still create the search.ts <-> physics.ts ESM import
- * cycle this module exists to avoid (r2 critic HIGH,
- * docs/plans/2026-07-09-recall-determinism.md T2).
+ * cycle this module exists to avoid.
  *
  * Mirrors the deliberate-determinism comment style already established in
  * graph-stream.ts:88, :165-168, :233-236 — a sort with a documented,
@@ -21,11 +20,9 @@
  * independently-created stores (different directory name, different insert
  * order of everything else on disk) sorts identically. The metadata keys make
  * byte-identical twins order by what they carry instead of by `id`
- * (`crypto.randomUUID()`), which is per-instance random: before v1.38.1 the
- * dedupe survivor of two twins that differed only in tags or source was
- * whichever id sorted first, and a semantic/episodic pair always kept the
- * episodic copy because `mem_` sorts before `sem_`. `id` stays the terminal
- * key so the order is total within one store.
+ * (`crypto.randomUUID()`), which is per-instance random and would make the
+ * dedupe survivor arbitrary. `id` stays the terminal key so the order is
+ * total within one store.
  *
  * Layer rank puts semantic first: semantic rows are consolidation output, so
  * keeping that copy preserves the promotion instead of demoting the memory.
@@ -36,8 +33,8 @@
  * Plain `<`/`>`, NOT `localeCompare`: `localeCompare` is locale- and
  * ICU-version-dependent (a determinism leak in its own right) and needlessly
  * slow for a tiebreak that only needs a total order. The metadata keys are
- * only computed on a content tie, which is rare post-T1 (path-tag embedding
- * fix), so the per-compare Set/sort cost never lands on the hot path.
+ * only computed on a content tie, which is rare, so the per-compare Set/sort
+ * cost never lands on the hot path.
  */
 export function compareEntryIdentity(a, b) {
     return (compareStrings(a.content, b.content) ||
@@ -90,13 +87,11 @@ export function compareScoredResults(a, b) {
  *
  * `ScoredPhysicsResult` (physics.ts) carries `{ memoryId, baseScore,
  * clusterAmplification, finalScore }` -- NO `entry`/`content` in scope at
- * that layer, so `compareEntryIdentity` cannot apply directly (plan T2
- * shape (c)). With only the default memoryId key this is PER-INSTANCE-ONLY
- * determinism; callers that need CROSS-INGEST stability supply `tieKeyOf`
- * mapping the result to its memory CONTENT (codex review finding: the
- * baseScore tie order selects the cluster_top_k amplification set, which
- * MUTATES scores before the downstream content-aware merge sort runs -- so
- * the tie key must be content-stable at THIS layer, not just downstream).
+ * that layer, so `compareEntryIdentity` cannot apply directly. With only the
+ * default memoryId key this is PER-INSTANCE-ONLY determinism; callers that need
+ * CROSS-INGEST stability supply `tieKeyOf` mapping the result to its memory
+ * CONTENT, because the baseScore tie order selects the cluster_top_k
+ * amplification set, which MUTATES scores before the content-aware merge sort.
  *
  * A factory (not a fixed-field comparator) because physics.ts re-sorts the
  * same result array by two different score fields in sequence (`baseScore`

package/dist/config.d.ts

@@ -64,34 +64,33 @@ export interface HippoConfig {
         enabled: boolean;
         budget: number;
         /** Skip a block identical to the one already injected this session
-         *  (ROADMAP TE2). Default true. Needs a session id from the hook payload. */
+         *  Default true. Needs a session id from the hook payload. */
         skipUnchanged: boolean;
         /** Resend an unchanged block after this many consecutive skips, so long
          *  sessions still see pinned rules near the latest turn. Default 10; 0
          *  never resends an unchanged block. */
         refreshTurns: number;
-        /** Z1: gate the hook's backfill on the prompt's own content instead of
-         *  the five newest memories. Default true since 1.55.0: overlap tied but median
-         *  tokens fell 847 to 533 (docs/evals/2026-09-26-z1-prompt-recall-result.md). */
+        /** Gate the hook's backfill on the prompt's own content instead of the five
+         *  newest memories. Default true: the same overlap for fewer tokens. */
         promptRecall: boolean;
-        /** Z1: overlap metric for the prompt-recall gate. Default 'jaccard' (tuned, docs/evals/2026-09-26-z1-prompt-recall-result.md). */
+        /** Overlap metric for the prompt-recall gate. Default 'jaccard' (tuned). */
         promptRecallMetric: PromptRecallMetric;
-        /** Z1: minimum overlap score to admit a candidate. Default 0.04 (tuned). */
+        /** Minimum overlap score to admit a candidate. Default 0.04 (tuned). */
         promptRecallThreshold: number;
-        /** Z1: minimum shared tokens to admit a candidate. Default 2. */
+        /** Minimum shared tokens to admit a candidate. Default 2. */
         promptRecallMinShared: number;
-        /** Z1: max prompt-recall entries injected per prompt. Default 5 (tuned). */
+        /** Max prompt-recall entries injected per prompt. Default 5 (tuned). */
         promptRecallMaxItems: number;
-        /** Z1: FTS candidate pool size per store before gating. Default 100. */
+        /** FTS candidate pool size per store before gating. Default 100. */
         promptRecallCandidates: number;
     };
-    /** Memory scope isolation (v39): when true (default), ambient context
+    /** Memory scope isolation: when true (default), ambient context
      *  (`hippo context`, the UserPromptSubmit hook, /v1/context, MCP
      *  hippo_context) excludes memories owned by OTHER projects; explicit
      *  recall is unaffected. Set false to disable the ORIGIN PARTITION only -
      *  the secret veto is unconditional for ambient surfaces and no config or
      *  flag re-includes secret-flagged rows (explicit recall still returns
-     *  them). See docs/plans/2026-07-01-memory-scope-isolation.md. */
+     *  them). */
     contextProjectIsolation: boolean;
     extraction: {
         enabled: boolean | 'auto';
@@ -110,11 +109,8 @@ export interface HippoConfig {
     ambient: {
         enabled: boolean;
     };
-    /** LC2-E3: opt-in learned memory-value rescue veto on the sleep decay pass
-     *  (docs/plans/2026-08-10-lc2-e3-mv-wiring.md). Default OFF — the frozen
-     *  E2 weights (src/memory-value-weights.ts) only run when explicitly
-     *  enabled; no other knobs in v1 (the rescue budget is a code constant
-     *  tied to E2 evidence, not user-tunable). */
+    /** Opt-in learned memory-value rescue veto on the sleep decay pass. Default OFF: the frozen weights
+     *  (src/memory-value-weights.ts) only run when enabled; the rescue budget is a code constant, not user-tunable. */
     memoryValue: {
         enabled: boolean;
     };
@@ -131,8 +127,8 @@ export interface HippoConfig {
          *  Default 180. 0 keeps dormant memories forever. */
         retentionDays: number;
     };
-    /** FE2: tags a memory `churn-stale` when its named file/symbol/script
-     *  changed since storage. Default OFF - FE3 measures before it flips. */
+    /** Tags a memory `churn-stale` when its named file/symbol/script
+     *  changed since storage. Default OFF until a measurement justifies the flip. */
     churnStaleness: {
         enabled: boolean;
     };
@@ -150,6 +146,11 @@ export interface HippoConfig {
     pilot: {
         holdoutRateBp: number;
     };
+    /** How a folder's project is named. `remote: false` drops the origin-remote rule, leaving
+     *  `.hippo-project.json` then the folder name. Read from the global store's config only, so every store agrees. */
+    projectIdentity: {
+        remote: boolean;
+    };
 }
 export declare function loadConfig(hippoRoot: string): HippoConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -5,10 +5,11 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { DEFAULT_PHYSICS_CONFIG, mergePhysicsConfig } from './physics-config.js';
 import { DEFAULT_HALF_LIFE_DAYS } from './memory.js';
+import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from './search/types.js';
 import { log } from './log.js';
 const DEFAULT_CONFIG = {
     defaultHalfLifeDays: DEFAULT_HALF_LIFE_DAYS,
-    defaultBudget: 4000,
+    defaultBudget: DEFAULT_RECALL_BUDGET,
     defaultContextBudget: 3000,
     decayBasis: 'adaptive',
     autoLearnOnSleep: true,
@@ -36,7 +37,7 @@ const DEFAULT_CONFIG = {
         lambda: 0.7,
     },
     search: {
-        localBump: 1.2,
+        localBump: DEFAULT_LOCAL_BUMP,
     },
     replay: {
         count: 5,
@@ -92,6 +93,9 @@ const DEFAULT_CONFIG = {
     pilot: {
         holdoutRateBp: 0,
     },
+    projectIdentity: {
+        remote: true,
+    },
 };
 function isMemoryValueConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -132,6 +136,17 @@ function pilotHoldoutRate(value) {
         `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
     return 0;
 }
+// Only a real false turns the remote rule off; anything else malformed warns and keeps it on.
+function projectIdentityRemote(value) {
+    const remote = value?.remote;
+    if (remote === true || remote === false)
+        return remote;
+    if (value === undefined || (remote === undefined && value !== null && value.constructor === Object))
+        return true;
+    log.warn(`config.json's "projectIdentity" must be an object like {"remote": false} ` +
+        `(got ${JSON.stringify(value)}) - using true (projects named by their origin remote).`);
+    return true;
+}
 function agentMemoryTools(value) {
     if (value === undefined || value === null)
         return null;
@@ -141,6 +156,70 @@ function agentMemoryTools(value) {
         `(got ${JSON.stringify(value)}) - importing none.`);
     return [];
 }
+function memoryValueOverride(raw) {
+    // Spreading a non-object raw.memoryValue (e.g. {"memoryValue": true}) silently leaves `enabled` false;
+    // this feature must never be silently off, so warn loudly and fall back to defaults instead.
+    const memoryValueRaw = raw.memoryValue;
+    const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
+    if (!validMemoryValueConfig) {
+        log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
+            `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
+    }
+    return memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
+}
+function dormantSettings(raw) {
+    // Same rule as memoryValue above: a malformed value never silently
+    // changes what sleep does. Anything but a real object / boolean / number
+    // warns and falls back to the default, which keeps faded memories.
+    const dormantRaw = raw.dormant;
+    if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
+        log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
+            `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
+    }
+    const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
+    // Only a real boolean counts: {"enabled": "false"} is a truthy string.
+    let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
+    if (dormantEnabled !== true && dormantEnabled !== false) {
+        log.warn(`config.json's "dormant.enabled" must be true or false ` +
+            `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
+        dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
+    }
+    let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
+    if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
+        log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
+            `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
+        dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
+    }
+    return { enabled: dormantEnabled, retentionDays: dormantRetentionDays };
+}
+function churnStalenessEnabled(raw) {
+    // Same "never silently wrong" rule as memoryValue/dormant above.
+    const churnStalenessRaw = raw.churnStaleness;
+    const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
+    if (!validChurnStalenessConfig) {
+        log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
+            `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
+    }
+    const enabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
+        ? churnStalenessRaw.enabled
+        : DEFAULT_CONFIG.churnStaleness.enabled;
+    if (enabled !== true && enabled !== false) {
+        log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
+            `(got ${JSON.stringify(enabled)}) - using false.`);
+        return false;
+    }
+    return enabled;
+}
+function defaultHalfLifeDays(raw) {
+    // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
+    const days = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
+    if (!Number.isFinite(days) || days <= 0) {
+        log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
+            `(got ${JSON.stringify(days)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
+        return DEFAULT_CONFIG.defaultHalfLifeDays;
+    }
+    return days;
+}
 export function loadConfig(hippoRoot) {
     const configPath = path.join(hippoRoot, 'config.json');
     if (!fs.existsSync(configPath))
@@ -149,66 +228,12 @@ export function loadConfig(hippoRoot) {
         const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
         const basis = raw.decayBasis;
         const validBasis = basis === 'clock' || basis === 'session' || basis === 'adaptive';
-        // Review-round F6: {...DEFAULT_CONFIG.memoryValue, ...raw.memoryValue}
-        // silently no-ops when raw.memoryValue is a non-object (e.g. the user
-        // wrote {"memoryValue": true}) — spreading a boolean/primitive/array
-        // contributes no enumerable own properties, so `enabled` stays at the
-        // default `false` with zero indication anything was wrong. This
-        // feature's whole point is "never silently off": warn loudly and fall
-        // back to defaults instead of merging garbage.
-        const memoryValueRaw = raw.memoryValue;
-        const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
-        if (!validMemoryValueConfig) {
-            log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
-                `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
-        }
-        const memoryValueOverride = memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
-        // Same rule as memoryValue above: a malformed value never silently
-        // changes what sleep does. Anything but a real object / boolean / number
-        // warns and falls back to the default, which keeps faded memories.
-        const dormantRaw = raw.dormant;
-        if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
-            log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
-                `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
-        }
-        const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
-        // Only a real boolean counts: {"enabled": "false"} is a truthy string.
-        let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
-        if (dormantEnabled !== true && dormantEnabled !== false) {
-            log.warn(`config.json's "dormant.enabled" must be true or false ` +
-                `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
-            dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
-        }
-        let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
-        if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
-            log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
-                `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
-            dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
-        }
-        // Same "never silently wrong" rule as memoryValue/dormant above.
-        const churnStalenessRaw = raw.churnStaleness;
-        const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
-        if (!validChurnStalenessConfig) {
-            log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
-                `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
-        }
-        let churnStalenessEnabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
-            ? churnStalenessRaw.enabled
-            : DEFAULT_CONFIG.churnStaleness.enabled;
-        if (churnStalenessEnabled !== true && churnStalenessEnabled !== false) {
-            log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
-                `(got ${JSON.stringify(churnStalenessEnabled)}) - using false.`);
-            churnStalenessEnabled = false;
-        }
-        // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
-        let defaultHalfLifeDays = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
-        if (!Number.isFinite(defaultHalfLifeDays) || defaultHalfLifeDays <= 0) {
-            log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
-                `(got ${JSON.stringify(defaultHalfLifeDays)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
-            defaultHalfLifeDays = DEFAULT_CONFIG.defaultHalfLifeDays;
-        }
+        const memoryValue = memoryValueOverride(raw);
+        const dormant = dormantSettings(raw);
+        const churnEnabled = churnStalenessEnabled(raw);
+        const halfLifeDays = defaultHalfLifeDays(raw);
         return {
-            defaultHalfLifeDays,
+            defaultHalfLifeDays: halfLifeDays,
             defaultBudget: raw.defaultBudget ?? DEFAULT_CONFIG.defaultBudget,
             defaultContextBudget: raw.defaultContextBudget ?? DEFAULT_CONFIG.defaultContextBudget,
             decayBasis: validBasis ? basis : DEFAULT_CONFIG.decayBasis,
@@ -232,18 +257,16 @@ export function loadConfig(hippoRoot) {
             ambient: { ...DEFAULT_CONFIG.ambient, ...(raw.ambient ?? {}) },
             memoryValue: {
                 ...DEFAULT_CONFIG.memoryValue,
-                ...memoryValueOverride,
-            },
-            dormant: {
-                enabled: dormantEnabled,
-                retentionDays: dormantRetentionDays,
+                ...memoryValue,
             },
+            dormant,
             churnStaleness: {
-                enabled: churnStalenessEnabled,
+                enabled: churnEnabled,
             },
             agentMemories: { tools: agentMemoryTools(raw.agentMemories?.tools) },
             deliveryLedger: { enabled: deliveryLedgerEnabled(raw.deliveryLedger) },
             pilot: { holdoutRateBp: pilotHoldoutRate(raw.pilot) },
+            projectIdentity: { remote: projectIdentityRemote(raw.projectIdentity) },
         };
     }
     catch (err) {