hippo-memory 1.61.0 → 1.63.0

package/dist/embedding-provider.d.ts

@@ -8,14 +8,10 @@
  * read their key from a conventional env var. The provider is selected by
  * `config.embeddings.provider` (default `'local'`).
  *
- * Design contract (see docs/plans/2026-06-08-b-pluggable-embedding-provider.md):
- *   - Local provider `id` is the BARE model string. (Historical note: this
- *     originally guaranteed NO identity change on upgrade; since the
- *     embed-text-format versioning in embeddings.ts (`embeddingIndexIdentity`,
- *     `${id}#t2`, docs/plans/2026-07-09-recall-determinism.md T1), the STORED
- *     identity carries a `#t<N>` suffix and pre-#t2 stores get exactly one
- *     forced reindex on their next embed-touching operation — deliberate,
- *     because their vectors were computed over path-contaminated text.)
+ * Design contract:
+ *   - Local provider `id` is the BARE model string; the STORED identity adds a `#t<N>`
+ *     embed-text-format suffix (`embeddingIndexIdentity`), so older stores reindex once:
+ *     their vectors were computed over path-contaminated text.
  *   - API provider `id` is `${kind}:${model}`; switching to/from an API embedder
  *     (or a dimension change) flips the identity and triggers the existing
  *     reindex-on-change path.

package/dist/embedding-provider.js

@@ -8,14 +8,10 @@
  * read their key from a conventional env var. The provider is selected by
  * `config.embeddings.provider` (default `'local'`).
  *
- * Design contract (see docs/plans/2026-06-08-b-pluggable-embedding-provider.md):
- *   - Local provider `id` is the BARE model string. (Historical note: this
- *     originally guaranteed NO identity change on upgrade; since the
- *     embed-text-format versioning in embeddings.ts (`embeddingIndexIdentity`,
- *     `${id}#t2`, docs/plans/2026-07-09-recall-determinism.md T1), the STORED
- *     identity carries a `#t<N>` suffix and pre-#t2 stores get exactly one
- *     forced reindex on their next embed-touching operation — deliberate,
- *     because their vectors were computed over path-contaminated text.)
+ * Design contract:
+ *   - Local provider `id` is the BARE model string; the STORED identity adds a `#t<N>`
+ *     embed-text-format suffix (`embeddingIndexIdentity`), so older stores reindex once:
+ *     their vectors were computed over path-contaminated text.
  *   - API provider `id` is `${kind}:${model}`; switching to/from an API embedder
  *     (or a dimension change) flips the identity and triggers the existing
  *     reindex-on-change path.

package/dist/embeddings.js

@@ -314,7 +314,7 @@ export async function embedMemory(hippoRoot, entry, model) {
         try {
             const identity = provider.id;
             if (embeddingModelRequiresReindex(hippoRoot, identity)) {
-                // L9: host-wide rebuild. The embedding index is keyed by entry.id
+                // Host-wide rebuild. The embedding index is keyed by entry.id
                 // (which is tenant-scoped) but the index itself is one per hippoRoot.
                 // Cross-tenant content equivalence is visible at the vector level.
                 // Per-tenant indices would be a larger architecture change.
@@ -357,6 +357,57 @@ export async function embedMemory(hippoRoot, entry, model) {
         log.warn(`skipped embedding ${entry.id} (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
     });
 }
+/** Throws when an unavailable provider is a misconfiguration rather than an intentional no-op. */
+function throwIfProviderKeyMissing(hippoRoot, provider) {
+    // A configured (non-disabled) API provider with a missing key is a
+    // misconfiguration, not a no-op: surface it so programmatic callers of the
+    // exported embedAll() learn nothing was written. Local-not-installed and an
+    // explicit enabled=false stay silent no-ops (best-effort / intentional).
+    const cfg = loadConfig(hippoRoot).embeddings;
+    if (provider.kind !== 'local' &&
+        cfg.enabled !== false &&
+        provider.keyEnv &&
+        !envByName(provider.keyEnv)?.trim()) {
+        throw new Error(`Embedding provider '${provider.kind}' is configured but ${provider.keyEnv} is not set.`);
+    }
+}
+// Embed entries without a cached vector in save-checkpointed chunks.
+// provider.embed batches internally (one HTTP request per batchSize for API
+// providers; sequential for local). A `[]` row means that single item could
+// not be embedded and is left for a later run (resumable). On a hard provider
+// failure mid-backfill we persist the chunks already embedded this run rather
+// than discarding paid progress, then stop and resume on the next run.
+async function backfillPending(hippoRoot, provider, pending, model) {
+    let count = 0;
+    // Initialized to `undefined` (not a known-evidence literal like `null`) so
+    // it stays a plain `unknown` binding for the arbitrary caught value below;
+    // falsy either way, so `if (backfillError)` behaves identically.
+    let backfillError = undefined;
+    const SAVE_CHUNK = 64;
+    for (let i = 0; i < pending.length; i += SAVE_CHUNK) {
+        const chunk = pending.slice(i, i + SAVE_CHUNK);
+        let vectors;
+        try {
+            vectors = await provider.embed(chunk.map((e) => embeddingInputText(e)), 'passage');
+        }
+        catch (err) {
+            // Preserve the chunks already saved this run, then surface the failure
+            // below so the explicit `hippo embed` path never reports a false success.
+            backfillError = err;
+            break;
+        }
+        const rows = [];
+        for (let j = 0; j < chunk.length; j++) {
+            const vec = vectors[j];
+            if (vec && vec.length > 0)
+                rows.push([chunk[j].id, vec]);
+            else
+                noteSkippedEmbedding(chunk[j].id);
+        }
+        count += withVectorDb(hippoRoot, (db) => upsertVectors(db, rows, model));
+    }
+    return { count, backfillError };
+}
 /**
  * Embed all entries in hippoRoot that don't already have cached vectors.
  * Prunes orphaned embeddings for memories that no longer exist.
@@ -364,22 +415,12 @@ export async function embedMemory(hippoRoot, entry, model) {
  */
 export async function embedAll(hippoRoot, model, provider = resolveEmbeddingProvider(hippoRoot, { model })) {
     if (!provider.isAvailable()) {
-        // A configured (non-disabled) API provider with a missing key is a
-        // misconfiguration, not a no-op: surface it so programmatic callers of the
-        // exported embedAll() learn nothing was written. Local-not-installed and an
-        // explicit enabled=false stay silent no-ops (best-effort / intentional).
-        const cfg = loadConfig(hippoRoot).embeddings;
-        if (provider.kind !== 'local' &&
-            cfg.enabled !== false &&
-            provider.keyEnv &&
-            !envByName(provider.keyEnv)?.trim()) {
-            throw new Error(`Embedding provider '${provider.kind}' is configured but ${provider.keyEnv} is not set.`);
-        }
+        throwIfProviderKeyMissing(hippoRoot, provider);
         return 0;
     }
     return withEmbedLock(hippoRoot, async () => {
         const identity = provider.id;
-        // L9: host-wide by design. embedAll backfills vectors for all tenants'
+        // Host-wide by design. embedAll backfills vectors for all tenants'
         // entries into the per-host embedding index. Per-tenant filtering would
         // produce partial indices and break recall.
         const entries = loadAllEntries(hippoRoot);
@@ -395,41 +436,8 @@ export async function embedAll(hippoRoot, model, provider = resolveEmbeddingProv
             deleteOrphanVectors(db);
             return storedVectorIds(db);
         });
-        // Embed entries without a cached vector in save-checkpointed chunks.
-        // provider.embed batches internally (one HTTP request per batchSize for API
-        // providers; sequential for local). A `[]` row means that single item could
-        // not be embedded and is left for a later run (resumable). On a hard provider
-        // failure mid-backfill we persist the chunks already embedded this run rather
-        // than discarding paid progress, then stop and resume on the next run.
         const pending = entries.filter((e) => !embedded.has(e.id));
-        let count = 0;
-        // Initialized to `undefined` (not a known-evidence literal like `null`) so
-        // it stays a plain `unknown` binding for the arbitrary caught value below;
-        // falsy either way, so `if (backfillError)` behaves identically.
-        let backfillError = undefined;
-        const SAVE_CHUNK = 64;
-        for (let i = 0; i < pending.length; i += SAVE_CHUNK) {
-            const chunk = pending.slice(i, i + SAVE_CHUNK);
-            let vectors;
-            try {
-                vectors = await provider.embed(chunk.map((e) => embeddingInputText(e)), 'passage');
-            }
-            catch (err) {
-                // Preserve the chunks already saved this run, then surface the failure
-                // below so the explicit `hippo embed` path never reports a false success.
-                backfillError = err;
-                break;
-            }
-            const rows = [];
-            for (let j = 0; j < chunk.length; j++) {
-                const vec = vectors[j];
-                if (vec && vec.length > 0)
-                    rows.push([chunk[j].id, vec]);
-                else
-                    noteSkippedEmbedding(chunk[j].id);
-            }
-            count += withVectorDb(hippoRoot, (db) => upsertVectors(db, rows, model));
-        }
+        const { count, backfillError } = await backfillPending(hippoRoot, provider, pending, model);
         saveStoredEmbeddingModel(hippoRoot, identity);
         // Partial progress is now persisted; surface a hard backfill failure so the
         // explicit embed path reports it (best-effort callers go via embedMemory).

package/dist/env.d.ts

@@ -35,7 +35,7 @@ export declare function envTenant(): string;
 export declare function envSkipAutoIntegrations(): boolean;
 export declare function envSkipPostinstall(): boolean;
 export declare function envMcpStdio(): boolean;
-/** Any non-empty value counts, unlike the `=1` switches. */
+/** `1` or `true`, so `0` and `false` turn it off; `true` stays on for anyone who set it that way. */
 export declare function envRequireServer(): boolean;
 export declare function envRequireSessionScopedFreshTail(): boolean;
 export declare function envStdinWaitMs(): number | undefined;

package/dist/env.js

@@ -15,9 +15,9 @@ function positiveInt(name) {
     const parsed = Number.parseInt(raw(name) ?? '', 10);
     return parsed > 0 ? parsed : undefined;
 }
-/** parseInt, kept when nonzero: these sites have always used `|| default`, so a negative value passes through. */
-function nonZeroInt(name) {
-    return Number.parseInt(raw(name) ?? '', 10) || undefined;
+/** Trimmed, with an empty or whitespace-only value read as unset. */
+function trimmed(name) {
+    return raw(name)?.trim() || undefined;
 }
 /** The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support bundles). */
 export function processEnv() {
@@ -61,10 +61,10 @@ export function envHippoHome() { return raw('HIPPO_HOME')?.trim(); }
 export function envXdgDataHome() { return raw('XDG_DATA_HOME')?.trim(); }
 export function envHomeDir() { return raw('HOME') || raw('USERPROFILE'); }
 export function envPath() { return raw('PATH'); }
-export function envModelCache() { return raw('HIPPO_MODEL_CACHE'); }
+export function envModelCache() { return trimmed('HIPPO_MODEL_CACHE'); }
 // Session, scope and tenant.
-export function envHippoSessionId() { return raw('HIPPO_SESSION_ID'); }
-export function envClaudeCodeSessionId() { return raw('CLAUDE_CODE_SESSION_ID'); }
+export function envHippoSessionId() { return trimmed('HIPPO_SESSION_ID'); }
+export function envClaudeCodeSessionId() { return trimmed('CLAUDE_CODE_SESSION_ID'); }
 export function envScope() { return raw('HIPPO_SCOPE'); }
 export function envGstackSkill() { return raw('GSTACK_SKILL'); }
 export function envOpenclawSkill() { return raw('OPENCLAW_SKILL'); }
@@ -76,8 +76,8 @@ export function envTenant() {
 export function envSkipAutoIntegrations() { return isOne('HIPPO_SKIP_AUTO_INTEGRATIONS'); }
 export function envSkipPostinstall() { return isOne('HIPPO_SKIP_POSTINSTALL'); }
 export function envMcpStdio() { return isOne('HIPPO_MCP_STDIO'); }
-/** Any non-empty value counts, unlike the `=1` switches. */
-export function envRequireServer() { return Boolean(raw('HIPPO_REQUIRE_SERVER')); }
+/** `1` or `true`, so `0` and `false` turn it off; `true` stays on for anyone who set it that way. */
+export function envRequireServer() { return isOneOrTrue('HIPPO_REQUIRE_SERVER'); }
 export function envRequireSessionScopedFreshTail() { return isOne('HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL'); }
 export function envStdinWaitMs() { return positiveInt('HIPPO_STDIN_WAIT_MS'); }
 export function envLogLevel() { return raw('HIPPO_LOG')?.trim().toLowerCase() ?? ''; }
@@ -89,18 +89,18 @@ export function envApiKey() { return raw('HIPPO_API_KEY'); }
 export function envClientIpHeader() { return raw('HIPPO_CLIENT_IP_HEADER')?.trim().toLowerCase(); }
 export function envTrustedProxies() { return raw('HIPPO_TRUSTED_PROXIES'); }
 export function envMcpSseMaxStreams() { return positiveInt('MCP_SSE_MAX_STREAMS'); }
-export function envMcpSseHeartbeatMs() { return nonZeroInt('MCP_SSE_HEARTBEAT_MS'); }
-export function envMcpSseMaxAgeSec() { return nonZeroInt('MCP_SSE_MAX_AGE_SEC'); }
+export function envMcpSseHeartbeatMs() { return positiveInt('MCP_SSE_HEARTBEAT_MS'); }
+export function envMcpSseMaxAgeSec() { return positiveInt('MCP_SSE_MAX_AGE_SEC'); }
 // LLM and reranker credentials and knobs.
 export function envAnthropicApiKey() { return raw('ANTHROPIC_API_KEY'); }
 export function envLlmTimeoutMs() { return positiveInt('HIPPO_LLM_TIMEOUT_MS'); }
-export function envTypesafeApiKey() { return raw('TYPESAFE_API_KEY'); }
+export function envTypesafeApiKey() { return trimmed('TYPESAFE_API_KEY'); }
 export function envJevTimeoutMs() { return positiveInt('HIPPO_JEV_TIMEOUT_MS'); }
 export function envJevModel() { return raw('HIPPO_JEV_MODEL'); }
 export function envLlmRerankerUrl() { return raw('HIPPO_LLM_RERANKER_URL'); }
 export function envLlmRerankerKey() { return raw('HIPPO_LLM_RERANKER_KEY'); }
 export function envLlmRerankerModel() { return raw('HIPPO_LLM_RERANKER_MODEL'); }
-export function envLlmRerankerTimeoutMs() { return nonZeroInt('HIPPO_LLM_RERANKER_TIMEOUT_MS'); }
+export function envLlmRerankerTimeoutMs() { return positiveInt('HIPPO_LLM_RERANKER_TIMEOUT_MS'); }
 export function envClefEndpoint() { return raw('HIPPO_CLEF_ENDPOINT')?.trim(); }
 export function envClefEndpointToken() { return raw('HIPPO_CLEF_ENDPOINT_TOKEN')?.trim() || undefined; }
 export function envClefTimeoutMs() { return raw('HIPPO_CLEF_TIMEOUT_MS'); }

package/dist/escape.d.ts

@@ -0,0 +1,5 @@
+/** Escape LIKE metacharacters for a query that declares `ESCAPE '\'`. */
+export declare function escapeLike(term: string): string;
+/** Escape a string for use as a literal inside a RegExp source. */
+export declare function escapeRegex(s: string): string;
+//# sourceMappingURL=escape.d.ts.map

package/dist/escape.js

@@ -0,0 +1,10 @@
+// Leaf module: literal-match escapes, kept in one place so every LIKE and RegExp caller escapes the same set.
+/** Escape LIKE metacharacters for a query that declares `ESCAPE '\'`. */
+export function escapeLike(term) {
+    return term.replace(/[%_\\]/g, '\\$&');
+}
+/** Escape a string for use as a literal inside a RegExp source. */
+export function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=escape.js.map

package/dist/eval-stats.d.ts

@@ -1,6 +1,5 @@
 /**
- * Statistics and cost accounting for the token-efficiency evals (ROADMAP
- * Part IX, TE3-TE5).
+ * Statistics and cost accounting for the token-efficiency evals.
  *
  * - Cost: price provider usage over four buckets (uncached input, cache
  *   write, cache read, output). Raw token counts overstate savings when most

package/dist/eval-stats.js

@@ -1,6 +1,5 @@
 /**
- * Statistics and cost accounting for the token-efficiency evals (ROADMAP
- * Part IX, TE3-TE5).
+ * Statistics and cost accounting for the token-efficiency evals.
  *
  * - Cost: price provider usage over four buckets (uncached input, cache
  *   write, cache read, output). Raw token counts overstate savings when most

package/dist/eval-suite.js

@@ -37,17 +37,13 @@ function mem(id, content, opts = {}) {
         entry.created = opts.created;
     return entry;
 }
-export function buildSyntheticCorpus() {
-    const entries = [];
-    const cases = [];
-    // =========================================================================
-    // 1. DIRECT RECALL — basic keyword matching
-    // =========================================================================
+/** Direct recall: basic keyword matching. */
+function addDirectRecall(entries, cases) {
     entries.push(mem('dr-1', 'The PostgreSQL database migration failed because the users table had a NOT NULL constraint on the email column', { created: dateOffset(1), tags: ['topic:database'] }), mem('dr-2', 'React component rendering performance improved by 40% after memoizing the expensive computation in useMemo', { created: dateOffset(2), tags: ['topic:frontend'] }), mem('dr-3', 'The API rate limiter should use a sliding window algorithm instead of fixed window to prevent burst traffic', { created: dateOffset(3), tags: ['topic:api'] }), mem('dr-4', 'Docker container memory limits need to be set to 512MB for the worker service to prevent OOM kills', { created: dateOffset(4), tags: ['topic:devops'] }), mem('dr-5', 'The JWT token expiration was set to 24 hours but should be reduced to 1 hour for security compliance', { created: dateOffset(5), tags: ['topic:security'] }), mem('dr-6', 'Webpack bundle size grew to 2.3MB because lodash was imported as a whole instead of cherry-picking', { created: dateOffset(6), tags: ['topic:frontend'] }), mem('dr-7', 'The Redis cache TTL for user sessions should match the JWT expiration to prevent stale sessions', { created: dateOffset(7), tags: ['topic:caching'] }), mem('dr-8', 'GraphQL resolver for nested comments has N+1 query problem solved by DataLoader batching', { created: dateOffset(8), tags: ['topic:api'] }));
     cases.push({ id: 'dr-q1', category: 'direct-recall', query: 'PostgreSQL migration NOT NULL constraint', expectedIds: ['dr-1'], description: 'exact keyword match on DB migration' }, { id: 'dr-q2', category: 'direct-recall', query: 'React useMemo performance memoizing', expectedIds: ['dr-2'], description: 'React performance optimization' }, { id: 'dr-q3', category: 'direct-recall', query: 'sliding window rate limiter API', expectedIds: ['dr-3'], description: 'API rate limiting approach' }, { id: 'dr-q4', category: 'direct-recall', query: 'Docker OOM memory limits worker', expectedIds: ['dr-4'], description: 'Docker memory config' }, { id: 'dr-q5', category: 'direct-recall', query: 'JWT token expiration security', expectedIds: ['dr-5'], description: 'JWT security setting' }, { id: 'dr-q6', category: 'direct-recall', query: 'webpack bundle size lodash', expectedIds: ['dr-6'], description: 'bundle size issue' }, { id: 'dr-q7', category: 'direct-recall', query: 'Redis cache TTL session expiration', expectedIds: ['dr-7'], description: 'cache TTL config' }, { id: 'dr-q8', category: 'direct-recall', query: 'GraphQL N+1 DataLoader batching', expectedIds: ['dr-8'], description: 'GraphQL N+1 fix' });
-    // =========================================================================
-    // 2. EXTRACTION PREFERENCE — extracted facts should rank above raw source
-    // =========================================================================
+}
+/** Extraction preference: extracted facts should rank above raw source. */
+function addExtractionPreference(entries, cases) {
     entries.push(mem('ep-src-1', 'speaker:Alice: So we had this big meeting yesterday about the deployment pipeline and Bob mentioned that the staging environment is using Kubernetes 1.28 and we should upgrade to 1.30 before the end of Q2 because of the security patches', {
         created: dateOffset(10), tags: ['speaker:Alice', 'topic:infrastructure', 'session:meeting-1'],
     }), mem('ep-ext-1', 'The staging environment runs Kubernetes 1.28 and needs to be upgraded to 1.30 before end of Q2 for security patches', {
@@ -65,9 +61,9 @@ export function buildSyntheticCorpus() {
         extracted_from: 'ep-src-3',
     }));
     cases.push({ id: 'ep-q1', category: 'extraction-preference', query: 'Kubernetes upgrade staging environment', expectedIds: ['ep-ext-1'], description: 'extracted fact about K8s upgrade should rank above raw utterance' }, { id: 'ep-q2', category: 'extraction-preference', query: 'Datadog Grafana alerting migration', expectedIds: ['ep-ext-2'], description: 'extracted fact about monitoring switch' }, { id: 'ep-q3', category: 'extraction-preference', query: 'OAuth2 PKCE login page redesign', expectedIds: ['ep-ext-3'], description: 'extracted fact about auth work' });
-    // =========================================================================
-    // 3. DAG DRILL-DOWN — summary nodes should surface children
-    // =========================================================================
+}
+/** Dag drill-down: summary nodes should surface children. */
+function addDagDrilldown(entries, cases) {
     entries.push(mem('dag-child-1', 'The API response time for /users endpoint degraded from 50ms to 300ms after adding the permissions check', {
         created: dateOffset(15), layer: Layer.Semantic, tags: ['topic:api-performance', 'extracted'],
         dag_level: 1,
@@ -86,14 +82,14 @@ export function buildSyntheticCorpus() {
         child.dag_parent_id = 'dag-summary-1';
     }
     cases.push({ id: 'dag-q1', category: 'dag-drilldown', query: 'API performance problems latency', expectedIds: ['dag-child-1', 'dag-child-2', 'dag-child-3', 'dag-summary-1'], description: 'summary should drill down to all children' }, { id: 'dag-q2', category: 'dag-drilldown', query: 'endpoint response time degradation', expectedIds: ['dag-child-1', 'dag-child-2', 'dag-summary-1'], description: 'query matching summary should surface relevant children' });
-    // =========================================================================
-    // 4. TEMPORAL — recency/oldest cues should affect ranking
-    // =========================================================================
+}
+/** Temporal: recency/oldest cues should affect ranking. */
+function addTemporal(entries, cases) {
     entries.push(mem('tmp-1', 'The team decided to use TypeScript for the new service', { created: dateOffset(-30), tags: ['topic:architecture'] }), mem('tmp-2', 'The team evaluated Rust as an alternative language for the service', { created: dateOffset(-20), tags: ['topic:architecture'] }), mem('tmp-3', 'The team added Go as a candidate language for the service rewrite', { created: dateOffset(-10), tags: ['topic:architecture'] }), mem('tmp-4', 'The team finalized the language choice as Go for the service rewrite', { created: dateOffset(-1), tags: ['topic:architecture'] }));
     cases.push({ id: 'tmp-q1', category: 'temporal', query: 'what did the team recently decide about the service language', expectedIds: ['tmp-4'], description: 'recent cue should boost newest entry' }, { id: 'tmp-q2', category: 'temporal', query: 'what was the first language choice for the service', expectedIds: ['tmp-1'], description: 'oldest cue should boost earliest entry' }, { id: 'tmp-q3', category: 'temporal', query: 'latest update on the service rewrite language', expectedIds: ['tmp-4'], description: 'latest should boost most recent' }, { id: 'tmp-q4', category: 'temporal', query: 'original architecture decision for the service', expectedIds: ['tmp-1'], description: 'original should boost earliest' });
-    // =========================================================================
-    // 5. NOISE RESISTANCE — relevant memories found despite noise
-    // =========================================================================
+}
+/** Noise resistance: relevant memories found despite noise. */
+function addNoiseResistance(entries, cases) {
     // Add 30 noise entries
     const noiseTopics = [
         'breakfast meeting catering ordered sandwiches', 'office temperature thermostat adjusted',
@@ -121,9 +117,9 @@ export function buildSyntheticCorpus() {
         created: dateOffset(21), tags: ['topic:security', 'topic:s3'],
     }));
     cases.push({ id: 'nr-q1', category: 'noise-resistance', query: 'database connection pool exhausted max connections', expectedIds: ['nr-1'], description: 'find DB issue despite 30 noise entries' }, { id: 'nr-q2', category: 'noise-resistance', query: 'S3 bucket public access security misconfiguration', expectedIds: ['nr-2'], description: 'find S3 issue despite noise' }, { id: 'nr-q3', category: 'noise-resistance', query: 'PostgreSQL migration constraint', expectedIds: ['dr-1'], description: 'find earlier DB entry despite noise' }, { id: 'nr-q4', category: 'noise-resistance', query: 'JWT token security expiration', expectedIds: ['dr-5'], description: 'find security entry despite noise' });
-    // =========================================================================
-    // 6. MULTI-HOP — entity chaining across sessions
-    // =========================================================================
+}
+/** Multi-hop: entity chaining across sessions. */
+function addMultiHop(entries, cases) {
     entries.push(mem('mh-1', 'speaker:Alice works on the payment gateway integration with Stripe. She found a webhook signature validation bug.', {
         created: dateOffset(25), tags: ['speaker:Alice', 'topic:payments'],
     }), mem('mh-2', 'speaker:Bob reviewed the Stripe webhook code and confirmed the signature validation uses the wrong secret key from the test environment.', {
@@ -134,6 +130,16 @@ export function buildSyntheticCorpus() {
         created: dateOffset(28), tags: ['speaker:Carol', 'topic:billing'],
     }));
     cases.push({ id: 'mh-q1', category: 'multi-hop', query: 'Who fixed the Stripe webhook bug and what was the root cause?', expectedIds: ['mh-1', 'mh-2', 'mh-3'], description: 'chain Alice -> Stripe -> Bob -> fix' }, { id: 'mh-q2', category: 'multi-hop', query: 'What are all the payment-related issues the team discussed?', expectedIds: ['mh-1', 'mh-2', 'mh-3', 'mh-4'], description: 'find all payment topics across speakers' });
+}
+export function buildSyntheticCorpus() {
+    const entries = [];
+    const cases = [];
+    addDirectRecall(entries, cases);
+    addExtractionPreference(entries, cases);
+    addDagDrilldown(entries, cases);
+    addTemporal(entries, cases);
+    addNoiseResistance(entries, cases);
+    addMultiHop(entries, cases);
     return { entries, cases };
 }
 // ---------------------------------------------------------------------------

package/dist/extract.js

@@ -6,9 +6,7 @@ import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { neverAutoShareTags } from './shared.js';
 import { log } from './log.js';
-function isJsonString(value) {
-    return typeof value === 'string';
-}
+import { isJsonString } from './json.js';
 const EXTRACTION_PROMPT = `You are extracting factual statements from a conversation or memory entry. Extract 1-8 standalone factual statements that would be useful to remember later.
 
 Rules:
@@ -101,15 +99,12 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
                 source: source.source,
                 extracted_from: source.id,
                 scope: source.scope,
-                // T1 executor check (2026-08-15 hardening pass): same defect as the
-                // consolidate.ts merge/trace passes — createMemory with no tenantId
-                // option stamps 'default' (memory.ts:535) regardless of the source
-                // entry's own tenant. Thread it through so extracted facts land in
-                // the same tenant as the episodic memory they were extracted from.
+                // Without it createMemory stamps 'default', and extracted facts leave
+                // the tenant of the episodic memory they were extracted from.
                 tenantId: source.tenantId,
                 baseHalfLifeDays,
             }), origin_project: source.origin_project };
-        // AT1 containment: a refusal is per-VALUE — one rejected fact must not
+        // A refusal is per-VALUE: one rejected fact must not
         // drop the rest of this batch. writeEntry has already audited the
         // refusal (reject_refusal) before rethrowing, so skip-and-count here.
         try {

package/dist/failure-log.d.ts

@@ -1,4 +1,4 @@
-/** Failure log (ROADMAP CD13): every failed tool call the capture-error hook sees, stored or not. */
+/** Failure log: every failed tool call the capture-error hook sees, stored or not. */
 import type { CaptureErrorOutcome, RoutineRule } from './capture-error.js';
 import type { DatabaseSyncLike } from './db.js';
 /** Rows older than this are pruned on write, which also bounds how far back a repeat can be found. */
@@ -31,9 +31,9 @@ export interface SessionFailures {
     /** Of those, failures whose signature another session hit first. */
     repeats: number;
 }
-/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm. */
 export declare function failuresBySession(db: DatabaseSyncLike, tenantId: string, sinceIso: string): SessionFailures[];
-/** Failure log totals over a window, for {@link summarizeFailures}. Counts only: a rate needs a holdout arm (CD11). */
+/** Failure log totals over a window, for {@link summarizeFailures}. Counts only: a rate needs a holdout arm. */
 export interface FailureSummary {
     /** ISO start of the window (inclusive). */
     since: string;

package/dist/failure-log.js

@@ -11,7 +11,7 @@ export function recordFailure(db, event) {
     const cutoff = new Date(Date.parse(now) - FAILURE_LOG_RETENTION_DAYS * 86_400_000).toISOString();
     db.prepare(`DELETE FROM failure_log WHERE ts < ?`).run(cutoff);
 }
-/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm. */
 export function failuresBySession(db, tenantId, sinceIso) {
     // SAFETY: the SELECT names exactly these three TEXT columns.
     const rows = db.prepare(`SELECT ts, session_id, sig_hash FROM failure_log

package/dist/forward-claim-detector.d.ts

@@ -1,5 +1,5 @@
 /**
- * J3.2 forward-claim detector — pure-function regex set + token extraction.
+ * Forward-claim detector: pure-function regex set + token extraction.
  *
  * No DB. No state. No dependencies beyond stdlib regex + String.
  *
@@ -13,9 +13,7 @@
  * Iteration signal: the `recall_autodebias_hint_no_class_match` audit op
  * (emitted by computePlanningFallacyOutput when a phrase matches but no class
  * resolves) is the telemetry channel for deciding whether to add an
- * embedding-based detector in J3.3.
- *
- * Plan: docs/plans/2026-05-26-j32-auto-injection.md (Task 1).
+ * embedding-based detector.
  */
 export interface ForwardClaimMatch {
     /** The regex match snippet, e.g. "will take" or "~3 days". Surfaced

package/dist/forward-claim-detector.js

@@ -1,5 +1,5 @@
 /**
- * J3.2 forward-claim detector — pure-function regex set + token extraction.
+ * Forward-claim detector: pure-function regex set + token extraction.
  *
  * No DB. No state. No dependencies beyond stdlib regex + String.
  *
@@ -13,12 +13,10 @@
  * Iteration signal: the `recall_autodebias_hint_no_class_match` audit op
  * (emitted by computePlanningFallacyOutput when a phrase matches but no class
  * resolves) is the telemetry channel for deciding whether to add an
- * embedding-based detector in J3.3.
- *
- * Plan: docs/plans/2026-05-26-j32-auto-injection.md (Task 1).
+ * embedding-based detector.
  */
 /**
- * Patterns ship-locked at v1.13.x. Each pattern is intentionally narrow —
+ * Each pattern is intentionally narrow:
  * adding a pattern should require evidence from the
  * `recall_autodebias_hint_no_class_match` audit channel that real forward-
  * claims are slipping through, NOT speculative "this might match more".
@@ -29,8 +27,7 @@
  */
 // Reused fragment for ALL duration-suffix patterns. Requires a digit + unit
 // so 'will take ownership' / 'ship in Docker' (no time component) don't
-// match. Codex round 2 P2: patterns that allowed verb-only matches fired
-// on every-day non-estimate queries that happened to share a class-token.
+// match: verb-only patterns fire on everyday non-estimate queries that share a class-token.
 // Accepts `<N> unit` (3 days), `a/an unit` (a week — implicit 1), and
 // `one unit` so natural English forward-claims aren't lost.
 const DURATION_TAIL = String.raw `(?:about|around|~|≈)?\s*(?:\d+|a|an|one)\s*(?:day|week|month|hour|hr|min(?:ute)?|sec(?:ond)?)s?\b`;
@@ -51,8 +48,7 @@ const FORWARD_CLAIM_PATTERNS = [
     // Lookbehind asserts start-of-string OR whitespace before the tilde
     // because \b before ~ requires a word char immediately preceding (~ is
     // not a word character), so /\b~/ would only match in 'foo~3 days'
-    // (malformed) and silently miss the legitimate cases. Codex review
-    // round 1 catch.
+    // (malformed) and silently miss the legitimate cases.
     /(?<=^|\s)~\s*\d+\s*(?:day|week|month|hour)s?\b/i,
     // Should + verb + duration tail. Same tightening as the leading 'will
     // take' rule: 'should ship by EOD' must include a quantifier.
@@ -78,8 +74,7 @@ const STOP_WORDS = new Set([
     // Duration units appear in every forward-claim phrase by design (the
     // regex set REQUIRES a `<N> <unit>` quantifier after the verb). Letting
     // them through to class resolution lets a class tag containing 'days'
-    // win or tie on the unit token instead of the domain token. Codex round
-    // 2 P3 catch.
+    // win or tie on the unit token instead of the domain token.
     'day', 'days', 'week', 'weeks', 'month', 'months',
     'hour', 'hours', 'hr', 'hrs',
     'min', 'mins', 'minute', 'minutes', 'sec', 'secs', 'second', 'seconds',

package/dist/goals.d.ts

@@ -60,7 +60,7 @@ export interface PushGoalOpts {
 }
 export declare function pushGoal(hippoRoot: string, opts: PushGoalOpts): Goal;
 /**
- * v1.7.4 — depth-cap enforcer extracted from pushGoalWithDb and resumeGoal.
+ * Depth-cap enforcer shared by pushGoalWithDb and resumeGoal.
  * If the (tenant, session) has >= MAX_ACTIVE_GOAL_DEPTH active goals,
  * suspend the oldest `overflow` ones.
  *
@@ -69,7 +69,7 @@ export declare function pushGoal(hippoRoot: string, opts: PushGoalOpts): Goal;
  * is impossible to misread the contract at a call site. Both existing call
  * sites (pushGoalWithDb, resumeGoal) wrap in `BEGIN IMMEDIATE` already.
  *
- * @internal v1.7.4 -- internal goal-stack invariant. Subject to change.
+ * @internal Internal goal-stack invariant. Subject to change.
  */
 export declare function enforceDepthCapWithinTx(db: DatabaseSyncLike, tenantId: string, sessionId: string): void;
 export declare function pushGoalWithDb(db: DatabaseSyncLike, opts: PushGoalOpts): Goal;
@@ -148,7 +148,7 @@ export declare function applyGoalStackBoost<R extends {
 export interface CompleteGoalOpts {
     outcomeScore?: number;
     /**
-     * v1.7.4 — when true, skip the strength-multiplier propagation block.
+     * When true, skip the strength-multiplier propagation block.
      * Default false (propagate). The goal's status still transitions to
      * 'completed' and `outcome_score` is still recorded; only the side-effect
      * on recalled memories' strength is suppressed.