hippo-memory 1.61.0 → 1.63.0

package/dist/connectors/slack/deletion.js

@@ -2,14 +2,9 @@ import { archiveRaw } from '../../api.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
 import { markEventSeen, hasSeenEvent } from './idempotency.js';
 /**
- * Handle Slack `message_deleted`. v0.39 commit 3 closes the prior race where
- * the archive committed but `markEventSeen` ran on a second db handle — a
- * crash between them left the deletion event un-acked, and the next retry
- * hit a now-archived row and returned `not_found` instead of `duplicate`.
- *
- * Fix: pass `afterArchive` to `archiveRaw`, which runs inside the same
- * SAVEPOINT as the archive itself. The slack_event_log row commits with the
- * archive or not at all.
+ * Handle Slack `message_deleted`. `afterArchive` runs inside the archive's own
+ * SAVEPOINT, so the slack_event_log row commits with the archive or not at all
+ * and a crash cannot leave a retry hitting `not_found` instead of `duplicate`.
  */
 export function handleMessageDeleted(ctx, input) {
     const db = openHippoDb(ctx.hippoRoot);

package/dist/connectors/slack/dlq.d.ts

@@ -15,7 +15,7 @@ export interface DlqItem {
     slackTimestamp: string | null;
 }
 /**
- * v0.39 commit 3: writeToDlq is now bucket-aware. `bucket` defaults to
+ * writeToDlq is bucket-aware. `bucket` defaults to
  * 'parse_error' to preserve the legacy single-arg call sites while letting
  * new callers tag rows for `hippo slack dlq replay` triage.
  *

package/dist/connectors/slack/ingest.d.ts

@@ -25,7 +25,7 @@ export interface IngestResult {
  *   and the SAVEPOINT, we throw `DuplicateEventError` to roll back the memory
  *   write. The pre-check `hasSeenEvent` stays as a fast path for the common
  *   already-seen case, but the afterWrite throw is what makes idempotency
- *   correct under two-worker concurrency (v0.39 commit 3 fix).
+ *   correct under two-worker concurrency.
  * - Empty-body messages return 'skipped' but still mark seen so a replay
  *   returns 'duplicate' rather than re-running the transform.
  */

package/dist/connectors/slack/ingest.js

@@ -15,7 +15,7 @@ import { messageToRememberOpts } from './transform.js';
  *   and the SAVEPOINT, we throw `DuplicateEventError` to roll back the memory
  *   write. The pre-check `hasSeenEvent` stays as a fast path for the common
  *   already-seen case, but the afterWrite throw is what makes idempotency
- *   correct under two-worker concurrency (v0.39 commit 3 fix).
+ *   correct under two-worker concurrency.
  * - Empty-body messages return 'skipped' but still mark seen so a replay
  *   returns 'duplicate' rather than re-running the transform.
  */
@@ -25,12 +25,8 @@ export function ingestMessage(ctx, input) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
         if (hasSeenEvent(db, input.eventId)) {
-            // v1.12.6 fix (B3): empty-body events mark seen with memory_id=NULL on
-            // first call (see line further down). Their replay should return the
-            // same 'skipped' status they originally returned, not 'duplicate' —
-            // the asymmetry was a paper-cut for callers that switch/case on
-            // status. memory_id=NULL is the discriminator. Non-NULL memory_id
-            // means an actual memory was ingested before, so 'duplicate' is correct.
+            // Empty-body events are marked seen with memory_id=NULL, so their replay returns the same 'skipped'
+            // they first returned; a non-NULL memory_id means a memory was ingested, so 'duplicate'.
             const cachedId = lookupMemoryByEvent(db, input.eventId);
             return { status: cachedId === null ? 'skipped' : 'duplicate', memoryId: cachedId };
         }
@@ -65,11 +61,8 @@ export function ingestMessage(ctx, input) {
     }
 }
 function rememberWithEventLog(ctx, eventId, opts) {
-    // v1.12.0: drop the legacy `|| 'connector:slack'` fallback — ctx is always
-    // provided by server.ts:1039 which constructs it with the connector subject.
-    // Under the new object-shaped Context.actor, an OR-fallback would evaluate
-    // an object as truthy and skip the fallback anyway (logic bug if ctx were
-    // ever missing); explicit reliance on the caller is safer.
+    // No `|| 'connector:slack'` fallback: the caller always builds ctx with the connector subject, and with
+    // an object-shaped Context.actor an OR-fallback would never fire anyway.
     const result = remember(ctx, {
         ...opts,
         untrusted: true,
@@ -101,10 +94,8 @@ function lostRaceResult(ctx, eventId) {
     }
 }
 function rejectedValueResult(ctx, eventId) {
-    // AT1 (plan §3 containment): a tombstone hit is a PERMANENT skip, not
-    // a transient failure — never DLQ-retry it (retrying would just hit
-    // the same refusal forever). Mark the event seen exactly like the
-    // empty-body branch above so a Slack retry acks as done, not error.
+    // A tombstone hit is a PERMANENT skip: a DLQ retry would hit the same refusal forever, so mark the
+    // event seen like the empty-body branch above and let a Slack retry ack as done, not error.
     const db4 = openHippoDb(ctx.hippoRoot);
     try {
         markEventSeen(db4, eventId, null);

package/dist/connectors/slack/signature.d.ts

@@ -4,7 +4,7 @@ export interface VerifyOpts {
     signature: string;
     signingSecret: string;
     /**
-     * Previous signing secret during a rotation. v0.39 commit 3: deploy with
+     * Previous signing secret during a rotation. Deploy with
      * both `SLACK_SIGNING_SECRET` (new) and `SLACK_SIGNING_SECRET_PREVIOUS` (old)
      * set, verify both work, drop previous after rollover. The verifier tries
      * `signingSecret` first, then `previousSecret` if that fails.

package/dist/connectors/slack/tenant-routing.d.ts

@@ -11,11 +11,9 @@ import type { DatabaseSyncLike } from '../../db.js';
  *     deployment's tenant). Escape hatch: SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1
  *     restores the env fallback for emergency rollback only.
  *
- * v0.39 commit 3 (CRITICAL #5): the previous version returned null on miss
- * unconditionally, and the route handler then fell back to HIPPO_TENANT —
- * which silently routed events from a foreign workspace into the deployment
- * tenant. The fail-closed contract lives here so every caller (route handler,
- * CLI replay, future MCP) gets the same protection.
+ * The fail-closed contract lives here so every caller (route handler, CLI
+ * replay, future MCP) gets the same protection against routing a foreign
+ * workspace's events into the deployment tenant.
  */
 export declare function resolveTenantForTeam(db: DatabaseSyncLike, teamId: string): string | null;
 //# sourceMappingURL=tenant-routing.d.ts.map

package/dist/connectors/slack/tenant-routing.js

@@ -11,11 +11,9 @@ import { envSlackAllowUnknownTeamFallback, envTenant } from '../../env.js';
  *     deployment's tenant). Escape hatch: SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1
  *     restores the env fallback for emergency rollback only.
  *
- * v0.39 commit 3 (CRITICAL #5): the previous version returned null on miss
- * unconditionally, and the route handler then fell back to HIPPO_TENANT —
- * which silently routed events from a foreign workspace into the deployment
- * tenant. The fail-closed contract lives here so every caller (route handler,
- * CLI replay, future MCP) gets the same protection.
+ * The fail-closed contract lives here so every caller (route handler, CLI
+ * replay, future MCP) gets the same protection against routing a foreign
+ * workspace's events into the deployment tenant.
  */
 export function resolveTenantForTeam(db, teamId) {
     // SAFETY: query selects only `tenant_id`, so a returned row has that shape;

package/dist/connectors/slack/transform.d.ts

@@ -12,18 +12,17 @@ export interface TransformInput {
  * without text). Caller treats null as "skip but mark idempotency seen".
  *
  * Contract:
- * - kind is the literal 'raw' (E1.x connector boundary, see src/importers.ts).
+ * - kind is the literal 'raw' (connector boundary, see src/importers.ts).
  * - artifact_ref format MUST be exactly `slack://${teamId}/${channelId}/${ts}`;
- *   the deletion path (Task 9) looks up by this string.
- * - owner is non-null whenever a row is written. Required by the v0.40.0
+ *   the deletion path looks up by this string.
+ * - owner is non-null whenever a row is written. Required by the
  *   provenance gate (`hippo provenance --strict`).
  *   - `user:<slack_user_id>` when the event carries a `user`.
  *   - `bot:<bot_id>` for the `bot_message` subtype (or any userless+text event
  *     that supplies bot_id).
  *   - `bot:unknown` only as a last-resort sentinel so the gate never sees null.
- *     Codex round 1 P1: skipping userless messages instead of stamping a bot
- *     owner would silently drop existing bot ingestion via the
- *     "skipped but seen" path at ingest.ts:54-65.
+ *     Skipping userless messages instead would silently drop bot ingestion
+ *     via the "skipped but seen" path in ingest.ts.
  */
 export declare function messageToRememberOpts(input: TransformInput): RememberOpts | null;
 //# sourceMappingURL=transform.d.ts.map

package/dist/connectors/slack/transform.js

@@ -5,18 +5,17 @@ import { scopeFromChannel } from './scope.js';
  * without text). Caller treats null as "skip but mark idempotency seen".
  *
  * Contract:
- * - kind is the literal 'raw' (E1.x connector boundary, see src/importers.ts).
+ * - kind is the literal 'raw' (connector boundary, see src/importers.ts).
  * - artifact_ref format MUST be exactly `slack://${teamId}/${channelId}/${ts}`;
- *   the deletion path (Task 9) looks up by this string.
- * - owner is non-null whenever a row is written. Required by the v0.40.0
+ *   the deletion path looks up by this string.
+ * - owner is non-null whenever a row is written. Required by the
  *   provenance gate (`hippo provenance --strict`).
  *   - `user:<slack_user_id>` when the event carries a `user`.
  *   - `bot:<bot_id>` for the `bot_message` subtype (or any userless+text event
  *     that supplies bot_id).
  *   - `bot:unknown` only as a last-resort sentinel so the gate never sees null.
- *     Codex round 1 P1: skipping userless messages instead of stamping a bot
- *     owner would silently drop existing bot ingestion via the
- *     "skipped but seen" path at ingest.ts:54-65.
+ *     Skipping userless messages instead would silently drop bot ingestion
+ *     via the "skipped but seen" path in ingest.ts.
  */
 export function messageToRememberOpts(input) {
     const text = input.message.text?.trim();

package/dist/connectors/slack/types.d.ts

@@ -2,6 +2,7 @@
  * Slack Events API envelope shapes used by the ingestion connector.
  * Spec: https://api.slack.com/events-api
  */
+import { type JsonValue } from '../../json.js';
 export interface SlackUrlVerification {
     type: 'url_verification';
     challenge: string;
@@ -18,18 +19,13 @@ export interface SlackMessageEvent {
     thread_ts?: string;
     /**
      * Slack `bot_message` subtype carries `bot_id` instead of `user`. The
-     * v0.40.0 provenance gate requires a non-null `owner`, so transform.ts
+     * provenance gate requires a non-null `owner`, so transform.ts
      * derives `owner: bot:<bot_id>` when `user` is absent.
      */
     bot_id?: string;
     /** Present on subtype='message_deleted'. */
     deleted_ts?: string;
 }
-/** JSON value shape for the parts of an inbound Slack payload not yet
- *  narrowed to a known envelope/event shape. */
-export type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
 export interface SlackEventEnvelope {
     type: 'event_callback';
     team_id: string;

package/dist/connectors/slack/types.js

@@ -2,9 +2,7 @@
  * Slack Events API envelope shapes used by the ingestion connector.
  * Spec: https://api.slack.com/events-api
  */
-function isJsonString(value) {
-    return typeof value === 'string';
-}
+import { isJsonString } from '../../json.js';
 function isJsonNumber(value) {
     return typeof value === 'number';
 }

package/dist/connectors/slack/web-client.js

@@ -1,7 +1,14 @@
 import { fetchWithRetry, isRetryableStatus } from '../../http-retry.js';
-function isJsonString(value) {
-    return typeof value === 'string';
-}
+import { isJsonString } from '../../json.js';
+/**
+ * Build a SlackHistoryFetcher that pages `conversations.history` over real
+ * HTTP. Wraps `fetchWithRetry` so 429 and 5xx handling is automatic. The returned
+ * fetcher is the one `backfillChannel` consumes.
+ *
+ * Slack omits `channel` from messages in the history response, so we stamp
+ * the request channel id onto each parsed message — downstream ingest needs
+ * it on every event.
+ */
 const SLACK_TIMEOUT_MS = 30_000;
 export function slackHistoryFetcher(token, fetchImpl) {
     return async ({ channelId, cursor, oldest }) => {

package/dist/connectors/slack/workspaces.d.ts

@@ -1,15 +1,13 @@
 /**
- * Slack workspace registration helpers (T2B follow-up, 2026-05-24).
+ * Slack workspace registration helpers.
  *
  * The `slack_workspaces` table maps Slack `team_id` → hippo `tenant_id`.
  * Empty table = single-tenant install (HIPPO_TENANT fallback).
  * Non-empty = multi-workspace install (fail-closed routing via
  * `resolveTenantForTeam`).
  *
- * Before T2B, populating this table required direct SQL — fine for a
- * single-machine deployment, awkward for operators with multiple
- * workspaces. These helpers give the CLI (`hippo slack workspaces
- * add|list|remove`) a clean surface.
+ * These helpers give the CLI (`hippo slack workspaces add|list|remove`) a
+ * surface, so operators with multiple workspaces need no direct SQL.
  *
  * Design choices:
  *   - `add` is an upsert (ON CONFLICT UPDATE). Re-registering an

package/dist/connectors/slack/workspaces.js

@@ -1,15 +1,13 @@
 /**
- * Slack workspace registration helpers (T2B follow-up, 2026-05-24).
+ * Slack workspace registration helpers.
  *
  * The `slack_workspaces` table maps Slack `team_id` → hippo `tenant_id`.
  * Empty table = single-tenant install (HIPPO_TENANT fallback).
  * Non-empty = multi-workspace install (fail-closed routing via
  * `resolveTenantForTeam`).
  *
- * Before T2B, populating this table required direct SQL — fine for a
- * single-machine deployment, awkward for operators with multiple
- * workspaces. These helpers give the CLI (`hippo slack workspaces
- * add|list|remove`) a clean surface.
+ * These helpers give the CLI (`hippo slack workspaces add|list|remove`) a
+ * surface, so operators with multiple workspaces need no direct SQL.
  *
  * Design choices:
  *   - `add` is an upsert (ON CONFLICT UPDATE). Re-registering an

package/dist/consolidate/conflicts.js

@@ -28,15 +28,11 @@ const CONFLICT_STOPWORDS = new Set([
 ]);
 /** Pairs of live non-semantic memories that contradict each other, in survivor order. */
 export function detectConflicts(entries, now, decayOpts = {}, 
-// LC2-E3 (opt-in, default off): ids rescued by this cycle's decay pass.
-// detectConflicts recomputes its own strength>=DECAY_THRESHOLD survivor
-// filter independently of the decay pass above; without this bypass,
-// rescued entries would be silently re-excluded from conflict detection
-// every cycle even though the decay pass just decided to keep them.
-// Default empty set: flag-off behavior is unchanged.
+// Ids this cycle's decay pass rescued: the survivor filter below is recomputed independently, so
+// without this bypass rescued entries would be silently re-excluded from conflict detection.
 rescuedIds = new Set()) {
     const survivors = entries.filter((entry) => entry.layer !== Layer.Semantic
-        // CD5: an unreviewed quarantined row must not taint a visible memory as conflicted.
+        // An unreviewed quarantined row must not taint a visible memory as conflicted.
         && !isQuarantineScope(entry.scope ?? null)
         && (rescuedIds.has(entry.id) || calculateStrength(entry, now, decayOpts) >= DECAY_THRESHOLD));
     const detected = [];
@@ -165,13 +161,6 @@ function inferConflictPolarity(text) {
         return 'positive';
     return 'neutral';
 }
-function stripConflictPolarity(text) {
-    return text
-        .toLowerCase()
-        .replace(/\b(?:not|never|no|don['’]?t|do\s+not|doesn['’]?t|does\s+not|can['’]?t|cannot|shouldn['’]?t|should\s+not|enabled|enable|disabled|disable|on|off|true|false|always|must|must\s+not|works?|working|missing|broken|failed|available|present)\b/g, ' ')
-        .replace(/\s+/g, ' ')
-        .trim();
-}
 function containsAny(text, needles) {
     return needles.some((needle) => text.includes(needle));
 }

package/dist/consolidate/decay.js

@@ -38,17 +38,8 @@ function keepSurvivor(run, entry, strength) {
 // -------------------------------------------------------------------------
 // 1. Decay pass
 // -------------------------------------------------------------------------
-// LC2-E3 (opt-in, default off; docs/plans/2026-08-10-lc2-e3-mv-wiring.md):
-// flag OFF keeps the single-phase loop below byte-identical to pre-E3
-// behavior (pre-registered gate G2). Flag ON restructures into two phases:
-// phase 1 classifies every entry (condemned vs survivor) with ZERO
-// commits; phase 2 runs rescueSet over the per-tenant candidate groups,
-// then commits — rescued entries get the standard survivor bookkeeping
-// refresh (stored strength + effective confidence; no half-life edits, no
-// rank-derived writes) and are pushed to survivors so they fully
-// participate in this cycle's merge/physics/conflict passes; non-rescued
-// condemned entries follow the existing pendingDeletes/result.removed/
-// details path.
+// Memory-value flag OFF runs the single-phase loop below. Flag ON classifies every entry with ZERO commits,
+// runs rescueSet per tenant, then commits; rescued entries stay full survivors for this cycle's later passes.
 export function decayPass(run) {
     if (run.config.memoryValue.enabled)
         return decayWithMemoryValue(run);
@@ -76,10 +67,8 @@ function reportNonFiniteScores(result, rankById) {
 }
 function decayWithMemoryValue(run) {
     const { all, now, result } = run;
-    // Carried forward to logRun, where the mv_rescue audit rows are actually
-    // written (code-review fix: writing them here, before batchWriteAndDelete,
-    // would assert rescues for a cycle whose effects might never land if a
-    // later phase throws).
+    // Carried forward to logRun, where the mv_rescue audit rows are written: writing them here, before
+    // batchWriteAndDelete, would assert rescues whose effects might never land if a later phase throws.
     const rescuedEntries = [];
     let rescuedIds = new Set();
     let rankById = new Map();
@@ -98,31 +87,22 @@ function decayWithMemoryValue(run) {
     // logRun stay !dryRun-gated), so the preview matches what a
     // real run would decide.
     const condemnedIds = new Set(condemned.map((e) => e.id));
-    // Fail-loud must not depend on condemnation traffic (round-2 code-review
-    // P2-2): validate the frozen weights constant unconditionally, even on a
-    // sleep with nothing condemned.
+    // Fail-loud must not depend on condemnation traffic: validate the frozen weights even when nothing is condemned.
     validateWeights();
     if (condemnedIds.size > 0) {
-        // Compute the per-tenant ranking ONCE (round-2 code-review P2-2):
-        // rankById feeds both rescueSet's decision (via precomputedRanks,
-        // skipping its own internal rankNonPinnedByTenant call) and the
-        // detail/audit rank context below, so the whole-store ranking pass
-        // runs a single time per sleep instead of twice, and only when there
-        // is actually something condemned to rank against.
+        // Rank per tenant ONCE: rankById feeds both rescueSet (via precomputedRanks) and the detail/audit
+        // context below, so the whole-store ranking runs once per sleep and only when something is condemned.
         rankById = rankNonPinnedByTenant(all, now);
         rescuedIds = rescueSet(all, condemnedIds, now, MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256, rankById);
         reportNonFiniteScores(result, rankById);
     }
     // --- Phase 2b: commit, one pass over `all` in ITS ORIGINAL ORDER ---
-    // (review-round F4: rescued entries used to be appended at the tail of
-    // survivors, systematically starving them in downstream order-sensitive
-    // passes like extraction's slice(0,20) — a single pass over `all`
-    // preserves flag-off's ordering semantics exactly.)
+    // Rescued entries appended at the tail would be starved by order-sensitive passes like extraction's slice(0,20).
     for (const entry of all) {
         const strength = strengthById.get(entry.id);
         if (run.retirable(entry) && strength < DECAY_THRESHOLD) {
             if (rescuedIds.has(entry.id)) {
-                // Rescued (D1): standard survivor stored-strength refresh (P2-1).
+                // Rescued: standard survivor stored-strength refresh.
                 // Confidence is left alone here: it is an epistemic tier, not a
                 // cached computation, so resolveConfidence derives it on read.
                 rescuedEntries.push(keepSurvivor(run, entry, strength));

package/dist/consolidate/llm-passes.js

@@ -72,9 +72,9 @@ async function dagBuildPass(run, { apiKey, llmError, llmOpts }) {
     }
 }
 // -------------------------------------------------------------------------
-// 1.8. DAG summary rebuild — drain dirty queue from E2's child-write hooks
+// 1.8. DAG summary rebuild — drain dirty queue from the child-write hooks
 // -------------------------------------------------------------------------
-// Consumer of E2's summary_dirty flag. Walks dirty L2 summaries, regenerates
+// Consumer of the summary_dirty flag. Walks dirty L2 summaries, regenerates
 // each via generateDagSummary, atomically refreshes content + 6 metadata
 // columns + clears summary_dirty (with FTS sync). Same apiKey/dryRun gate
 // as buildDag above. Cap HIPPO_DAG_REBUILD_CAP (default 20, hard ceiling
@@ -84,8 +84,7 @@ async function dagRebuildPass(run, { llmError, llmOpts }) {
     try {
         const { rebuildDirtySummaries } = await import('../dag.js');
         const rawCap = envDagRebuildCap();
-        // R1 MED must-fix: hard ceiling so misconfigured env can't burn
-        // unbounded LLM cost.
+        // Hard ceiling so a misconfigured env can't burn unbounded LLM cost.
         const cap = rawCap !== undefined ? Math.min(rawCap, 1000) : 20;
         const rebuildResult = await rebuildDirtySummaries(run.hippoRoot, { ...llmOpts, onError: llmError('dag rebuild'), cap });
         result.summariesRebuilt = rebuildResult.rebuilt;
@@ -115,7 +114,7 @@ async function dagRebuildPass(run, { llmError, llmOpts }) {
 // -------------------------------------------------------------------------
 // 1.9. DAG entity profiles — cluster L2 topic summaries into L3 profiles
 // -------------------------------------------------------------------------
-// E5 phase: aggregate per-entity L2 summaries (e.g. all the speaker:Alice
+// Aggregate per-entity L2 summaries (e.g. all the speaker:Alice
 // topic summaries) into a single L3 entity profile. Runs even when phase
 // 1.7 buildDag was skipped (re-clusters existing L2s every sleep).
 //

package/dist/consolidate/merge.js

@@ -54,13 +54,8 @@ export function mergePass(run) {
         && !e.pinned // a pin merged with a look-alike would read as one of two values
         && tokenize(e.content).length > 0);
     const used = new Set();
-    // T1 fix (2026-08-15 hardening pass): partition by tenantId BEFORE the
-    // overlap loop so a cluster can never span tenants. Previously textOverlap
-    // clustered across the whole host-wide `survivors` list with no tenant
-    // boundary, and mergeContents concatenated cross-tenant content into one
-    // row. Map preserves insertion order, so single-tenant stores (every row
-    // 'default') get exactly one partition and iterate in the same order as
-    // before this fix — byte-identical behavior there.
+    // Partition BEFORE the overlap loop so a cluster can never span tenants and merge cross-tenant content.
+    // Map keeps insertion order, so a single-tenant store gets one partition in the original order.
     const mergeCandidatesByTenant = new Map();
     for (const entry of mergeCandidates) {
         const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
@@ -70,12 +65,8 @@ export function mergePass(run) {
         else
             mergeCandidatesByTenant.set(key, [entry]);
     }
-    // AT1 consolidation-loop fix (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
-    // reuses the single consolidateDb handle opened lazily in consolidate()
-    // for the whole non-dry-run consolidate — see that
-    // declaration's comment. Only needed for real writes — a dry-run preview
-    // never reaches batchWriteAndDelete's guard bypass, so there is nothing
-    // here for it to protect against.
+    // The rejection guard reuses the one consolidateDb handle opened lazily in consolidate(); a dry-run
+    // never reaches batchWriteAndDelete's guard bypass, so it has nothing to protect there.
     let mergesSkippedRejected = 0;
     for (const [, tenantCandidates] of mergeCandidatesByTenant) {
         const partition = {
@@ -115,13 +106,8 @@ function mergeCluster(run, partition, cluster, related, used) {
     const mergedContent = mergeContents(cluster);
     const allTags = Array.from(new Set(cluster.flatMap((e) => e.tags))).sort();
     const maxValence = pickStrongestValence(cluster);
-    // AT1 P2 fix: build the semantic entry FIRST — createMemory is cheap
-    // and pure — so the tombstone check below runs under the tenant the
-    // row will ACTUALLY land in.
-    // T1 fix: createMemory now receives tenantId: mergeTenant (the
-    // partition's tenant — every member of `cluster` shares it by
-    // construction), so the row lands in its source tenant instead of
-    // always 'default'.
+    // Build the semantic entry FIRST (createMemory is cheap and pure) so the tombstone check below runs
+    // under the partition's tenant, the one every cluster member shares and the row will land in.
     let semantic = null;
     if (!dryRun) {
         semantic = {
@@ -152,9 +138,8 @@ function mergeCluster(run, partition, cluster, related, used) {
         result.semanticCreated++;
         // Demote source episodics (they've been compressed into neocortex):
         // scale half_life_days so they decay sooner while staying recoverable.
-        // Immediate ranking is deliberately unchanged: the 2026-06-10 DAG
-        // slice-1 eval measured that dropping children below a worse-retrieving
-        // summary regresses budget-bounded QA (docs/evals/). The stored
+        // Immediate ranking is deliberately unchanged: dropping children below a
+        // worse-retrieving summary regresses budget-bounded QA. The stored
         // strength is refreshed to the live value so inspect, replay sampling,
         // and strength-sorted assembly see the truth instead of a fake 0.3.
         // Mutate in place (not a copy): `cluster` holds the same object

package/dist/consolidate/run.d.ts

@@ -15,7 +15,7 @@ export interface ConsolidationResult {
     semanticCreated: number;
     replayed: number;
     promotedTraces: number;
-    /** T7: sessions skipped because their events span two derivation scopes. */
+    /** Sessions skipped because their events span two derivation scopes. */
     tracesSkippedMixedScope: number;
     extractionCandidates: number;
     extracted: number;
@@ -35,13 +35,6 @@ export interface ConsolidationResult {
 }
 export declare const REPLAY_COUNT_DEFAULT = 5;
 export declare function keptAsWritten(entry: MemoryEntry): boolean;
-/** JSON value shape for a session event's free-form metadata field, cast to
- *  once at its `Record<string, unknown>` origin so it can be narrowed via
- *  isJsonString below rather than left as unparsed `unknown`. */
-export type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export declare function isJsonString(value: JsonValue): value is string;
 /** The sleep's one tombstone-check handle: opened on first use, never under dryRun, closed once. */
 interface LazyDb {
     get: () => DatabaseSyncLike | null;

package/dist/consolidate/run.js

@@ -4,31 +4,9 @@ export const REPLAY_COUNT_DEFAULT = 5;
 export function keptAsWritten(entry) {
     return entry.tags.some((tag) => NO_MERGE_TAGS.has(tag));
 }
-export function isJsonString(value) {
-    return typeof value === 'string';
-}
-// AT1 rejection-guard db handle (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
-// covers BOTH the auto-promote pass (1.4) and the merge
-// pass (3) — both build deterministic content that
-// batchWriteAndDelete writes through the guard's bypass, so both need a
-// producer-side tombstone check before pushing to pendingWrites.
-//
-// T3 fix (2026-08-15 hardening pass, perf hygiene): memoized lazy getter,
-// not an eager open. The handle only serves these two tombstone checks —
-// a sleep with zero promotable sessions and zero merge clusters never
-// reaches either use site, so opening it unconditionally on every
-// non-dry-run sleep paid a db-open cost for nothing. dryRun still never
-// opens (getConsolidateDb short-circuits before touching the handle).
-// consolidateDbOpened (not just a truthy handle check) is the
-// single source of truth for "was this ever opened", so the finally
-// closes it exactly once and never double-opens.
-//
-// AT1 P2 fix (codex, handle-leak restructure): the getter's lifetime must
-// start IMMEDIATELY before the try whose finally closes it, covering every
-// phase that can touch it — not just the merge pass. An exception thrown by
-// auto-promote (1.4), replay (1.5), batch extraction (1.6), the DAG
-// passes (1.7-1.9), or physics (2) would otherwise propagate past an open handle
-// with nothing to close it.
+// Auto-promote (1.4) and merge (3) write deterministic content through the guard's bypass, so both
+// need this tombstone check. Lazy so a sleep reaching neither never opens it; call it IMMEDIATELY
+// before the try whose finally closes it, so a throw in any phase cannot leak the handle.
 export function lazyConsolidateDb(hippoRoot, dryRun) {
     let consolidateDbHandle = null;
     let consolidateDbOpened = false;

package/dist/consolidate/sleep.js

@@ -33,10 +33,8 @@ export async function consolidate(hippoRoot, options = {}) {
     const dryRun = options.dryRun ?? false;
     const result = newConsolidationResult(dryRun);
     const halfLife = migrateHalfLives(hippoRoot, dryRun, result);
-    // L9: host-wide by design. Consolidation runs across all tenants in one
-    // pass — per-tenant filtering would create N consolidation runs per host
-    // with no cross-tenant dedup. The api.sleep audit row tags this with the
-    // admin synthetic actor; see api.ts:2050 for the rationale.
+    // Host-wide by design: per-tenant filtering would mean N runs per host and no cross-tenant dedup.
+    // The api.sleep audit row tags this with the admin synthetic actor.
     const all = loadAllEntries(hippoRoot);
     if (dryRun)
         for (const e of all)
@@ -153,24 +151,14 @@ function logRun(run, decay) {
     if (decay.rescuedEntries.length > 0)
         auditRescues(run, decay);
 }
-// One audit row per rescue (attributability, D1). Written here, AFTER
-// batchWriteAndDelete has committed this cycle's writes/deletes
-// (and after conflict detection + run logging), not inline in the decay
-// pass — same durability posture as api.ts's top-level 'consolidate'
-// summary audit row (written only once the whole sleep has completed).
-// Writing it earlier would assert rescues for a cycle whose effects
-// never landed if a later phase threw. Real writes only — dry-run
-// previews the decision (details line above) but persists nothing.
+// One audit row per rescue, written only after batchWriteAndDelete commits: writing earlier
+// would assert rescues for a cycle whose effects never landed if a later phase threw.
 function auditRescues(run, { rescuedEntries, rankById }) {
     const { result } = run;
     try {
         const auditDb = openHippoDb(run.hippoRoot);
         try {
-            // Review-round F5: per-row try/catch, not one try/catch around the
-            // whole loop — a single failed appendAuditEvent must not silently
-            // drop every remaining row. Mirrors the physics pass's
-            // skipped-warning precedent: count losses, keep
-            // the overall fail-soft posture, tell the operator via details.
+            // Per-row try/catch: one failed appendAuditEvent must not silently drop every remaining row.
             let auditFailures = 0;
             for (const entry of rescuedEntries) {
                 try {