hippo-memory 1.61.0 → 1.63.0

package/dist/mcp/tools.js

@@ -1,7 +1,10 @@
 // Tool definitions and input schemas served by tools/list.
+import { DEFAULT_RECALL_BUDGET } from '../search/types.js';
+import { DEFAULT_ASSEMBLE_BUDGET } from '../api/assemble.js';
+import { MAX_ID_LEN } from '../http-util.js';
 // ── Tool definitions ──
-// HTTP sets no budget cap; 25x the 4000 recall default leaves room for large-context clients while bounding one call's work.
-const MAX_BUDGET_TOKENS = 100_000;
+// HTTP sets no budget cap; 25x the recall default leaves room for large-context clients while bounding one call's work.
+const MAX_BUDGET_TOKENS = 25 * DEFAULT_RECALL_BUDGET;
 // Same ceiling as the HTTP list routes' parseListLimit.
 const MAX_LIST_LIMIT = 1000;
 export const TOOLS = [
@@ -16,7 +19,7 @@ export const TOOLS = [
                     type: 'number',
                     minimum: 0,
                     maximum: MAX_BUDGET_TOKENS,
-                    description: `Max tokens to return (default: config.defaultBudget, 4000; max ${MAX_BUDGET_TOKENS})`,
+                    description: `Max tokens to return (default: config.defaultBudget, ${DEFAULT_RECALL_BUDGET}; max ${MAX_BUDGET_TOKENS})`,
                 },
                 include_continuity: {
                     type: 'boolean',
@@ -44,8 +47,8 @@ export const TOOLS = [
                 },
                 session_id: {
                     type: 'string',
-                    maxLength: 256,
-                    description: 'Optional session id (v1.7.4). When set AND (tenant, session) has active goals, applies the dlPFC goal-stack boost to the ranked memories before formatting. Mirrors fresh_tail_session_id shape (256-char cap).',
+                    maxLength: MAX_ID_LEN,
+                    description: `Optional session id (v1.7.4). When set AND (tenant, session) has active goals, applies the dlPFC goal-stack boost to the ranked memories before formatting. Mirrors fresh_tail_session_id shape (${MAX_ID_LEN}-char cap).`,
                 },
             },
             required: ['query'],
@@ -65,7 +68,7 @@ export const TOOLS = [
                     type: 'number',
                     minimum: 0,
                     maximum: MAX_BUDGET_TOKENS,
-                    description: `Token budget for the assembled context (default 4000; max ${MAX_BUDGET_TOKENS}). Eviction kicks in over budget.`,
+                    description: `Token budget for the assembled context (default ${DEFAULT_ASSEMBLE_BUDGET}; max ${MAX_BUDGET_TOKENS}). Eviction kicks in over budget.`,
                 },
                 fresh_tail_count: {
                     type: 'number',

package/dist/memory-value-weights.d.ts

@@ -1,20 +1,17 @@
 /**
- * LC2-E2 frozen learned memory-value weight vector.
+ * Frozen learned memory-value weight vector.
  *
- * GENERATED FROM the E2 frozen artifact
+ * GENERATED FROM the frozen artifact
  * (benchmarks/memory-value/weights-learned.json +
  * benchmarks/memory-value/weights-learned.meta.json). NEVER EDIT BY HAND —
  * tests/memory-value-wiring.test.ts's weights-sync test asserts this constant
  * equals the committed JSON artifact (value equality + digest match), so
  * drift between the artifact and this file fails CI.
  *
- * CAVEAT (verbatim from the E2 result doc, carried by design decision D3 /
- * binding constraint 4 in docs/plans/2026-08-10-lc2-e3-mv-wiring.md):
- * usage-feature signs reflect E1's anti-oracle simulation, NOT real usage
- * value. Never read this as production ranking advice — LC3 tests real
- * usage value.
+ * CAVEAT: usage-feature signs reflect an anti-oracle simulation, NOT real usage
+ * value. Never read this as production ranking advice.
  */
-/** The 8 live feature dims the E2 fitter optimized over (FIT_DIMS). */
+/** The 8 live feature dims the fitter optimized over (FIT_DIMS). */
 export declare const MEMORY_VALUE_WEIGHTS: Readonly<Record<string, number>>;
 /** sha256 of benchmarks/memory-value/weights-learned.json at freeze time
  *  (weights-learned.meta.json's `weightsFileSha256`). */

package/dist/memory-value-weights.js

@@ -1,20 +1,17 @@
 /**
- * LC2-E2 frozen learned memory-value weight vector.
+ * Frozen learned memory-value weight vector.
  *
- * GENERATED FROM the E2 frozen artifact
+ * GENERATED FROM the frozen artifact
  * (benchmarks/memory-value/weights-learned.json +
  * benchmarks/memory-value/weights-learned.meta.json). NEVER EDIT BY HAND —
  * tests/memory-value-wiring.test.ts's weights-sync test asserts this constant
  * equals the committed JSON artifact (value equality + digest match), so
  * drift between the artifact and this file fails CI.
  *
- * CAVEAT (verbatim from the E2 result doc, carried by design decision D3 /
- * binding constraint 4 in docs/plans/2026-08-10-lc2-e3-mv-wiring.md):
- * usage-feature signs reflect E1's anti-oracle simulation, NOT real usage
- * value. Never read this as production ranking advice — LC3 tests real
- * usage value.
+ * CAVEAT: usage-feature signs reflect an anti-oracle simulation, NOT real usage
+ * value. Never read this as production ranking advice.
  */
-/** The 8 live feature dims the E2 fitter optimized over (FIT_DIMS). */
+/** The 8 live feature dims the fitter optimized over (FIT_DIMS). */
 export const MEMORY_VALUE_WEIGHTS = Object.freeze({
     age_days: -0.3245577821391783,
     half_life_days: 0.11410695580440973,

package/dist/memory-value.d.ts

@@ -1,9 +1,9 @@
 /**
- * LC2-E3 — learned memory-value scorer, wired into the sleep decay pass as a
- * rescue-only veto (design D1/D2, docs/plans/2026-08-10-lc2-e3-mv-wiring.md).
+ * Learned memory-value scorer, wired into the sleep decay pass as a
+ * rescue-only veto.
  *
  * computeMvFeatures mirrors benchmarks/memory-value/extract.mjs's
- * computeFeatures for the 8 live dims the E2 fitter optimized over
+ * computeFeatures for the 8 live dims the fitter optimized over
  * (FIT_DIMS) — the only dims MEMORY_VALUE_WEIGHTS carries a weight for.
  * Any future edit to either side must keep them byte-equivalent; the parity
  * test in tests/memory-value-wiring.test.ts enforces this.
@@ -12,10 +12,10 @@
  * min-max normalization + weighted scorer (no additional orientation
  * multiply — the frozen weights already encode sign/orientation).
  *
- * rescueSet implements D1's rescue-only semantics: a condemned entry is
- * rescued iff its learned score ranks in the top 30% (RESCUE_BUDGET, the E2
- * keep-budget operating point) of its own tenant's non-pinned candidate set
- * (D2). Deletes(flag-on) subset Deletes(flag-off) by construction — this
+ * rescueSet implements rescue-only semantics: a condemned entry is
+ * rescued iff its learned score ranks in the top 30% (RESCUE_BUDGET, the
+ * measured keep-budget operating point) of its own tenant's non-pinned
+ * candidate set. Deletes(flag-on) subset Deletes(flag-off) by construction — this
  * function can only ever shrink the condemned set, never grow it.
  */
 import { type MemoryEntry } from './memory.js';
@@ -50,13 +50,13 @@ export declare function validateWeights(weights?: Readonly<Record<string, number
  * Min-max normalize each of the 8 features over the given entry set
  * (constant feature -> 0, matching evaluate.mjs), then score = dot(weights,
  * normalized). The normalization context is exactly the entries passed in —
- * callers control the bounded scope (D2: per-tenant, non-pinned).
+ * callers control the bounded scope (per-tenant, non-pinned).
  *
  * `weights` defaults to the real frozen singleton; parameterized (like
  * validateWeights) so callers/tests can score against an explicit vector
  * without touching the module singleton.
  *
- * Review-round F2 (non-finite features): Date.parse on a malformed `created`
+ * Non-finite features: Date.parse on a malformed `created`
  * string yields NaN, and NaN would silently corrupt every OTHER entry's
  * min-max in the same group. An entry with ANY non-finite computed feature
  * is excluded from the normalization context entirely (its raw values never
@@ -74,13 +74,13 @@ export interface MvRankInfo {
     score: number;
     /** 1-based rank by score DESC within the tenant's non-pinned candidate set. */
     rank: number;
-    /** Size of the tenant's non-pinned candidate set (D2). */
+    /** Size of the tenant's non-pinned candidate set. */
     totalNonPinned: number;
     /** ceil(RESCUE_BUDGET * totalNonPinned) — the rescue cutoff; rank <= keepN rescues. */
     keepN: number;
 }
 /**
- * Groups non-pinned entries by tenantId (D2), scores + ranks each tenant's
+ * Groups non-pinned entries by tenantId, scores + ranks each tenant's
  * group independently, and returns per-entry rank context for every
  * non-pinned entry (not just condemned ones) — the shared basis for both
  * rescueSet's rescue decision and consolidate.ts's audit-row rank context,
@@ -92,7 +92,7 @@ export interface MvRankInfo {
  */
 export declare function rankNonPinnedByTenant(entries: MemoryEntry[], now: Date, weights?: Readonly<Record<string, number>>, digest?: string): Map<string, MvRankInfo>;
 /**
- * D1 rescue decision: a condemned entry is rescued iff it ranks in the top
+ * Rescue decision: a condemned entry is rescued iff it ranks in the top
  * 30% of its tenant's non-pinned candidate set by learned score. Returns the
  * subset of condemnedIds that are rescued — the caller filters commits
  * (rescued -> survivors) and threads the same set into detectConflicts.
@@ -102,7 +102,7 @@ export declare function rankNonPinnedByTenant(entries: MemoryEntry[], now: Date,
  * "flag on + a broken constant throws" is directly testable end-to-end
  * through this function without mutating the frozen module singleton.
  *
- * `precomputedRanks` (round-2 code-review P2-2): when the caller has already
+ * `precomputedRanks`: when the caller has already
  * computed the per-tenant ranking (e.g. consolidate.ts needs it separately
  * for detail/audit rank context), pass it here to skip the internal
  * rankNonPinnedByTenant call — the whole-store ranking pass then runs

package/dist/memory-value.js

@@ -1,9 +1,9 @@
 /**
- * LC2-E3 — learned memory-value scorer, wired into the sleep decay pass as a
- * rescue-only veto (design D1/D2, docs/plans/2026-08-10-lc2-e3-mv-wiring.md).
+ * Learned memory-value scorer, wired into the sleep decay pass as a
+ * rescue-only veto.
  *
  * computeMvFeatures mirrors benchmarks/memory-value/extract.mjs's
- * computeFeatures for the 8 live dims the E2 fitter optimized over
+ * computeFeatures for the 8 live dims the fitter optimized over
  * (FIT_DIMS) — the only dims MEMORY_VALUE_WEIGHTS carries a weight for.
  * Any future edit to either side must keep them byte-equivalent; the parity
  * test in tests/memory-value-wiring.test.ts enforces this.
@@ -12,10 +12,10 @@
  * min-max normalization + weighted scorer (no additional orientation
  * multiply — the frozen weights already encode sign/orientation).
  *
- * rescueSet implements D1's rescue-only semantics: a condemned entry is
- * rescued iff its learned score ranks in the top 30% (RESCUE_BUDGET, the E2
- * keep-budget operating point) of its own tenant's non-pinned candidate set
- * (D2). Deletes(flag-on) subset Deletes(flag-off) by construction — this
+ * rescueSet implements rescue-only semantics: a condemned entry is
+ * rescued iff its learned score ranks in the top 30% (RESCUE_BUDGET, the
+ * measured keep-budget operating point) of its own tenant's non-pinned
+ * candidate set. Deletes(flag-on) subset Deletes(flag-off) by construction — this
  * function can only ever shrink the condemned set, never grow it.
  */
 import { calculateStrength } from './memory.js';
@@ -32,13 +32,13 @@ export const MV_FEATURE_NAMES = [
     'outcome_ratio',
     'content_length',
 ];
-/** The E2 keep-budget operating point (the only point with measured
- *  evidence) — a code constant tied to that evidence, not user-tunable. */
+/** The keep-budget operating point (the only point with measured
+ *  evidence): a code constant tied to that evidence, not user-tunable. */
 const RESCUE_BUDGET = 0.3;
 /**
- * Review-round F1 (small-tenant degeneracy): below this per-tenant
- * non-pinned candidate-set size, a rank statistic is noise — E2's evidence
- * says nothing about tiny scale — and the floor prevents immortal-entry
+ * Small-tenant degeneracy: below this per-tenant non-pinned candidate-set
+ * size, a rank statistic is noise (the measured evidence says nothing about
+ * tiny scale), and the floor prevents immortal-entry
  * convergence: keepN=ceil(0.3*N) guarantees >=1 rescue at N=1, so without a
  * floor a condemned-only 1-entry tenant would be rescued every single sleep
  * forever. A condemned-only tenant below the floor instead drains normally
@@ -108,13 +108,13 @@ export function validateWeights(weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_
  * Min-max normalize each of the 8 features over the given entry set
  * (constant feature -> 0, matching evaluate.mjs), then score = dot(weights,
  * normalized). The normalization context is exactly the entries passed in —
- * callers control the bounded scope (D2: per-tenant, non-pinned).
+ * callers control the bounded scope (per-tenant, non-pinned).
  *
  * `weights` defaults to the real frozen singleton; parameterized (like
  * validateWeights) so callers/tests can score against an explicit vector
  * without touching the module singleton.
  *
- * Review-round F2 (non-finite features): Date.parse on a malformed `created`
+ * Non-finite features: Date.parse on a malformed `created`
  * string yields NaN, and NaN would silently corrupt every OTHER entry's
  * min-max in the same group. An entry with ANY non-finite computed feature
  * is excluded from the normalization context entirely (its raw values never
@@ -166,7 +166,7 @@ export function scoreEntries(entries, now, weights = MEMORY_VALUE_WEIGHTS) {
     return scores;
 }
 /**
- * Groups non-pinned entries by tenantId (D2), scores + ranks each tenant's
+ * Groups non-pinned entries by tenantId, scores + ranks each tenant's
  * group independently, and returns per-entry rank context for every
  * non-pinned entry (not just condemned ones) — the shared basis for both
  * rescueSet's rescue decision and consolidate.ts's audit-row rank context,
@@ -181,11 +181,9 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
     const byTenant = new Map();
     for (const e of entries) {
         if (e.pinned)
-            continue; // D2: pinned entries never compete for rescue (never condemned)
-        // F9: guard undefined tenantId the same way dag.ts:341 does — the
-        // MemoryEntry type says `string`, but a raw/legacy row can still carry
-        // undefined at runtime, and grouping it under the literal key
-        // "undefined" would silently split it into its own singleton tenant.
+            continue; // pinned entries never compete for rescue (never condemned)
+        // Default an undefined tenantId as dag.ts:341 does: a raw/legacy row can carry one at runtime,
+        // and keying it "undefined" would split it into its own singleton tenant.
         const tenantId = e.tenantId ?? 'default';
         const list = byTenant.get(tenantId);
         if (list)
@@ -196,19 +194,13 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
     const result = new Map();
     for (const [tenantId, group] of byTenant) {
         const scores = scoreEntries(group, now, weights);
-        // score DESC -> compareEntryIdentity (content asc -> metadata -> id asc), the shared
-        // deterministic tie-break used by every score-primary sort site in this
-        // codebase (src/compare.ts). F2: `-Infinity - -Infinity` is NaN, not 0 —
-        // two non-finite-feature entries tied at -Infinity would otherwise fall
-        // through to `diff` (NaN), which Array.sort treats as "no preference"
-        // and leaves insertion-order-dependent. Route NaN through the same
-        // deterministic tie-break as an exact-zero diff.
+        // score DESC, then compareEntryIdentity, the shared tie-break of every score-primary sort (src/compare.ts).
+        // `-Infinity - -Infinity` is NaN, which Array.sort leaves insertion-order-dependent, so NaN ties too.
         const sorted = [...group].sort((a, b) => {
             const diff = scores.get(b.id) - scores.get(a.id);
             return diff === 0 || Number.isNaN(diff) ? compareEntryIdentity(a, b) : diff;
         });
-        // F1: tenants smaller than MIN_RESCUE_GROUP never rescue (keepN 0) — see
-        // that constant's doc comment.
+        // Tenants smaller than MIN_RESCUE_GROUP never rescue (keepN 0); see that constant's doc comment.
         const keepN = sorted.length < MIN_RESCUE_GROUP
             ? 0
             : Math.min(sorted.length, Math.ceil(RESCUE_BUDGET * sorted.length));
@@ -225,7 +217,7 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
     return result;
 }
 /**
- * D1 rescue decision: a condemned entry is rescued iff it ranks in the top
+ * Rescue decision: a condemned entry is rescued iff it ranks in the top
  * 30% of its tenant's non-pinned candidate set by learned score. Returns the
  * subset of condemnedIds that are rescued — the caller filters commits
  * (rescued -> survivors) and threads the same set into detectConflicts.
@@ -235,7 +227,7 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
  * "flag on + a broken constant throws" is directly testable end-to-end
  * through this function without mutating the frozen module singleton.
  *
- * `precomputedRanks` (round-2 code-review P2-2): when the caller has already
+ * `precomputedRanks`: when the caller has already
  * computed the per-tenant ranking (e.g. consolidate.ts needs it separately
  * for detail/audit rank context), pass it here to skip the internal
  * rankNonPinnedByTenant call — the whole-store ranking pass then runs
@@ -243,16 +235,13 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
  * computes it internally as before — existing callers/tests are unaffected.
  */
 export function rescueSet(entries, condemnedIds, now, weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256, precomputedRanks) {
-    validateWeights(weights, digest); // fail loud before any rescue computation (constraint 5)
+    validateWeights(weights, digest); // fail loud before any rescue computation
     const ranked = precomputedRanks ?? rankNonPinnedByTenant(entries, now, weights, digest);
     const rescued = new Set();
     for (const id of condemnedIds) {
         const info = ranked.get(id);
-        // F2: Number.isFinite(info.score) is an explicit, absolute guard — not
-        // just reliance on -Infinity naturally sorting last. In the degenerate
-        // case where every entry in a tenant is non-finite-scored (a tie at
-        // -Infinity), rank position alone could otherwise place one inside
-        // keepN; this makes "never rescued" hold regardless.
+        // An explicit finite guard, not just -Infinity sorting last: when a whole tenant
+        // ties at -Infinity, rank alone could place one inside keepN.
         if (info && info.rank <= info.keepN && Number.isFinite(info.score))
             rescued.add(id);
     }

package/dist/memory.d.ts

@@ -30,8 +30,8 @@ export type MemoryKind = 'raw' | 'distilled' | 'superseded' | 'archived';
  *
  * Byte-comparison sort (`<` / `>`) is chronological for any pair of
  * canonical UTC ISO strings. ~50× faster than `localeCompare` with no
- * semantic gain. F4 (v1.6.5) uses byte compare on `assemble`; if a future
- * import path admits non-canonical timestamps, the F4 sort and any
+ * semantic gain. `assemble` sorts by byte compare; if a future
+ * import path admits non-canonical timestamps, that sort and any
  * downstream chronological reasoning will need a normalization pass.
  */
 export interface MemoryEntry {
@@ -65,18 +65,18 @@ export interface MemoryEntry {
     descendant_count?: number;
     earliest_at?: string | null;
     latest_at?: string | null;
-    /** v28: 1 when this summary row has at least one child invalidated,
+    /** 1 when this summary row has at least one child invalidated,
      *  superseded, forgotten, or archived since it was last rebuilt. Cleared
-     *  by E3's rebuildDirtySummaries during sleep. Always 0 for non-summary
-     *  rows (dag_level !== 2; E5 widens to include 3). */
+     *  by rebuildDirtySummaries during sleep. Always 0 for non-summary
+     *  rows (dag_level !== 2). */
     summary_dirty?: 0 | 1;
-    /** v28: ISO 8601 timestamp of the last successful rebuild for this
+    /** ISO 8601 timestamp of the last successful rebuild for this
      *  summary, or null if never rebuilt. */
     last_rebuilt_at?: string | null;
-    /** v28: monotonically-increasing counter of successful rebuilds for this
-     *  summary. 0 for initial buildDag write; bumped by E3. */
+    /** Monotonically-increasing counter of successful rebuilds for this
+     *  summary. 0 for initial buildDag write; bumped by each rebuild. */
     rebuild_count?: number;
-    /** v28 (reserved for E5): ISO 8601 timestamp the level-3 entity profile
+    /** Reserved: ISO 8601 timestamp the level-3 entity profile
      *  was built. Only ever populated on dag_level=3 rows. */
     dag_level_3_built_at?: string | null;
     kind: MemoryKind;
@@ -85,16 +85,16 @@ export interface MemoryEntry {
     artifact_ref: string | null;
     tenantId: string;
     /**
-     * Memory scope isolation (schema v39): owning project for ambient-context
+     * Memory scope isolation: owning project for ambient-context
      * partitioning. A lowercased project name, '' for user-global (injectable
-     * everywhere), or null for legacy pre-v39 rows - ambient context treats
-     * null as other-project (deny). Stamped from the store's location at write
-     * time (store.ts stampOriginProject); undefined only on entries not yet
-     * written. See docs/plans/2026-07-01-memory-scope-isolation.md.
+     * everywhere), or null for legacy rows written before the column - ambient
+     * context treats null as other-project (deny). Stamped from the store's location
+     * at write time (store.ts stampOriginProject); undefined only on entries not yet
+     * written.
      */
     origin_project?: string | null;
     /**
-     * F1 (v1.7.0): raw SQLite FTS5 bm25() score from the FTS path of
+     * Raw SQLite FTS5 bm25() score from the FTS path of
      * `loadSearchEntries`.
      *
      * Populated ONLY when ALL of the following hold:
@@ -113,7 +113,7 @@ export interface MemoryEntry {
      */
     bm25_score?: number;
 }
-/** FE2: tag on a memory whose named file/symbol/script changed after it was stored. */
+/** Tag on a memory whose named file/symbol/script changed after it was stored. */
 export declare const CHURN_STALE_TAG = "churn-stale";
 /**
  * Test-only helper. Tests that mutate `process.env.HIPPO_LOSS_AVERSION_RATIO`
@@ -144,9 +144,9 @@ export declare function calculateRewardFactor(entry: Pick<MemoryEntry, 'outcome_
 export declare function netWrong(entry: Pick<MemoryEntry, 'outcome_positive' | 'outcome_negative'>): number;
 /**
  * Options for decay basis.
- * - clock: wall-clock time (default pre-v0.15)
+ * - clock: wall-clock time (former default)
  * - session: decay by sleep cycle count (for intermittent agents)
- * - adaptive: auto-scale half-life by session frequency (default v0.15+)
+ * - adaptive: auto-scale half-life by session frequency (default)
  */
 /** What calculateStrength reads, so a caller can score a row without loading its text. */
 export type StrengthInputs = Pick<MemoryEntry, 'pinned' | 'created' | 'last_retrieved' | 'half_life_days' | 'retrieval_count' | 'emotional_valence' | 'outcome_positive' | 'outcome_negative'>;
@@ -211,10 +211,8 @@ export declare function confidenceLabel(entry: MemoryEntry, now?: Date): {
 export declare function resolveConfidence(entry: MemoryEntry, now?: Date): ConfidenceLevel;
 /**
  * Base half-life for a new memory, in days, before `deriveHalfLife`'s
- * write-time multipliers. 365 since 1.46.0: the pre-registered E1 decision
- * (docs/evals/2026-09-24-decay-default-result.md and prereg-2) found 7 days
- * lost the current fact far more often (29% vs 75% in the top five), and
- * 730 days and decay off tied with 365. `hippo sleep` moves memories still
+ * write-time multipliers. 365 because 7 days lost the current fact far more
+ * often, and 730 days or no decay did no better. `hippo sleep` moves memories still
  * on an older base (src/half-life-migration.ts).
  */
 export declare const DEFAULT_HALF_LIFE_DAYS = 365;

package/dist/memory.js

@@ -14,19 +14,10 @@ export var Layer;
     Layer["Semantic"] = "semantic";
     Layer["Trace"] = "trace";
 })(Layer || (Layer = {}));
-/** FE2: tag on a memory whose named file/symbol/script changed after it was stored. */
+/** Tag on a memory whose named file/symbol/script changed after it was stored. */
 export const CHURN_STALE_TAG = 'churn-stale';
-// Emotional multipliers from PLAN.md.
-//
-// v1.13.5 / J5 loss-aversion calibration (Lovallo-Kahneman TFAS empirics:
-// losses ~2x larger than equivalent gains). Defaults rebalanced:
-//   - positive (success-tagged): 1.3 -> 1.0
-//   - negative (error-tagged):   1.5 -> 2.0
-//   - critical stays at 2.0 (literal roadmap reading; J5 silent on critical;
-//     ranking signal in consolidate.ts/salience.ts/ambient.ts unchanged)
-//   - neutral stays at 1.0
-//
-// `negative` is further scaled per-process by HIPPO_LOSS_AVERSION_RATIO
+// Emotional multipliers from PLAN.md. Losses weigh ~2x equivalent gains (Lovallo-Kahneman TFAS empirics),
+// so negative is 2.0. `negative` is further scaled per-process by HIPPO_LOSS_AVERSION_RATIO
 // (env var, default 1.0; see getLossAversionRatio + applyLossAversionRatio).
 const EMOTIONAL_MULTIPLIERS = {
     neutral: 1.0,
@@ -35,7 +26,7 @@ const EMOTIONAL_MULTIPLIERS = {
     critical: 2.0,
 };
 /**
- * v1.13.5 / J5 — module-level lazy-cached read of HIPPO_LOSS_AVERSION_RATIO.
+ * Module-level lazy-cached read of HIPPO_LOSS_AVERSION_RATIO.
  *
  * `calculateStrength` is called per-entry inside hot recall loops
  * (api.ts/consolidate.ts/search.ts), so a per-call `process.env` lookup
@@ -44,20 +35,19 @@ const EMOTIONAL_MULTIPLIERS = {
  * Test isolation via `_resetLossAversionRatioCacheForTests()` below.
  */
 /**
- * v1.13.5 minimum acceptable ratio. Below this, the negative multiplier
+ * Minimum acceptable ratio. Below this, the negative multiplier
  * (2.0 * ratio) becomes small enough that calculateStrength * decay can fall
  * below `DECAY_THRESHOLD = 0.05` in `src/consolidate.ts:146`, which would
  * permanently delete non-pinned error-tagged memories on the next sleep
- * cycle. 0.5 is chosen as the floor because (a) it recovers the v1.13.4
+ * cycle. 0.5 is chosen as the floor because (a) it recovers the pre-calibration
  * effective multiplier (2.0 * 0.5 = 1.0 + the negative premium, i.e. 1.5x
- * the v1.13.4 default), and (b) below this the user is asking for LESS
+ * the pre-calibration default), and (b) below this the user is asking for LESS
  * loss aversion than has ever shipped — that's outside the supported
- * tuning range. See codex-review-critic round 1 P1.
+ * tuning range.
  */
 const LOSS_AVERSION_RATIO_MIN = 0.5;
 /**
- * Validation policy (v1.13.5 + independent-review round-1 HIGH + codex
- * round-1 P1 folds):
+ * Validation policy:
  *   - Valid: finite numbers >= 0.5.
  *   - Invalid (silent fallback to 1.0): empty string, non-numeric,
  *     numbers below 0.5 (including 0 and negatives), NaN, +/-Infinity.
@@ -65,17 +55,16 @@ const LOSS_AVERSION_RATIO_MIN = 0.5;
  *     on a typo.
  *
  * Why the 0.5 floor and not 0:
- *   - codex-review-critic round 1 P1: rejecting only `0` (the original
- *     HIGH fold) leaves the same silent data-loss surface for any ratio
+ *   - Rejecting only `0` leaves the same silent data-loss surface for any ratio
  *     below ~0.025 (and worse for aged memories, where even ratio=0.25
  *     can produce strength < DECAY_THRESHOLD = 0.05 in consolidate.ts).
- *     Floor at the v1.13.4-equivalent (0.5) so the env var's tuning
+ *     Floor at the pre-calibration equivalent (0.5) so the env var's tuning
  *     range never crosses into the deletion regime.
- *   - Users wanting LESS loss aversion than v1.13.4's 1.5 multiplier
- *     should reconsider the design intent of J5 (the calibration was
+ *   - Users wanting LESS loss aversion than the pre-calibration 1.5 multiplier
+ *     should reconsider the design intent (the calibration was
  *     toward MORE loss aversion, not less). If a future use case
  *     genuinely needs ratio < 0.5, the right path is a separate
- *     `HIPPO_NEGATIVE_MULTIPLIER` env override (deferred to J5-v2).
+ *     `HIPPO_NEGATIVE_MULTIPLIER` env override.
  */
 let _lossAversionRatioCache;
 function getLossAversionRatio() {
@@ -111,8 +100,7 @@ export function _resetLossAversionRatioCacheForTests() {
 /**
  * Apply the loss-aversion ratio scalar to the `negative` multiplier ONLY.
  * Other valences (positive, critical, neutral) pass through unchanged.
- * `critical` is deliberately NOT scaled: J5 roadmap is silent on critical;
- * its multiplier is left alone so the calibration only touches the
+ * `critical` is deliberately NOT scaled, so the calibration only touches the
  * specific empirical claim (TFAS 2x losses-vs-gains).
  */
 function applyLossAversionRatio(valence, baseMultiplier) {
@@ -172,13 +160,9 @@ now = evalNow(), options = {}) {
     const wrongPenalty = Math.pow(0.5, Math.min(netWrong(entry), MAX_WRONG_HALVINGS));
     if (entry.pinned)
         return wrongPenalty;
-    // EVAL-ONLY ablation (see ablation.ts): with recall-strengthening ablated,
-    // anchor decay at CREATION, not last_retrieved. A never-strengthened memory
-    // decays from when it was made; using last_retrieved would let clock resets
-    // persisted by PRIOR unflagged runs leak strengthening into an ablated
-    // arm's rankings (codex P2). Identity on fresh stores (created ==
-    // last_retrieved at write). Prior-run half_life increments are NOT
-    // reconstructed - see the ablation.ts caveat (fresh stores per arm).
+    // EVAL-ONLY ablation (see ablation.ts): anchor decay at CREATION, so clock resets persisted by PRIOR
+    // unflagged runs cannot leak strengthening into an ablated arm. Prior-run half_life increments are
+    // NOT reconstructed - see the ablation.ts caveat (fresh stores per arm).
     const lastRetrieved = new Date(isRecallBoostAblated() ? entry.created : entry.last_retrieved);
     const daysSince = (now.getTime() - lastRetrieved.getTime()) / (1000 * 60 * 60 * 24);
     // Reward-proportional half-life modulation
@@ -212,19 +196,13 @@ now = evalNow(), options = {}) {
     // clamp below then caps retrievalBoost at baseline - see ablation.ts
     // formula note.
     const decay = isDecayAblated() ? 1.0 : Math.pow(0.5, decayExponent);
-    // Retrieval boost: 1 + 0.1 * log2(retrieval_count + 1)
-    // EVAL-ONLY ablation (see ablation.ts): the recall-boost flag neutralizes
-    // the READ side too, so a store with PRIOR retrieval history (counts > 0
-    // written before the flag was set) does not leak strengthening into an
-    // ablated arm's rankings (codex P2).
+    // Retrieval boost: 1 + 0.1 * log2(retrieval_count + 1). EVAL-ONLY ablation (see ablation.ts) neutralizes
+    // the READ side too, so counts written before the flag cannot leak strengthening into an ablated arm.
     const retrievalBoost = isRecallBoostAblated() || netWrong(entry) > 0
         ? 1.0
         : 1 + 0.1 * Math.log2(entry.retrieval_count + 1);
-    // Emotional multiplier
-    // v1.13.5 / J5: apply HIPPO_LOSS_AVERSION_RATIO to the negative multiplier
-    // ONLY (positive/critical/neutral pass through unchanged). Lazy module-cache
-    // means this is a single Map lookup + one numeric multiply, not a per-call
-    // process.env read.
+    // Emotional multiplier. HIPPO_LOSS_AVERSION_RATIO scales the negative one ONLY; the lazy
+    // module cache makes this one lookup + one multiply, not a per-call process.env read.
     const baseMultiplier = EMOTIONAL_MULTIPLIERS[entry.emotional_valence] ?? 1.0;
     const emotionalMultiplier = applyLossAversionRatio(entry.emotional_valence, baseMultiplier);
     const raw = decay * retrievalBoost * emotionalMultiplier;
@@ -335,10 +313,8 @@ export function resolveConfidence(entry, now = evalNow()) {
 }
 /**
  * Base half-life for a new memory, in days, before `deriveHalfLife`'s
- * write-time multipliers. 365 since 1.46.0: the pre-registered E1 decision
- * (docs/evals/2026-09-24-decay-default-result.md and prereg-2) found 7 days
- * lost the current fact far more often (29% vs 75% in the top five), and
- * 730 days and decay off tied with 365. `hippo sleep` moves memories still
+ * write-time multipliers. 365 because 7 days lost the current fact far more
+ * often, and 730 days or no decay did no better. `hippo sleep` moves memories still
  * on an older base (src/half-life-migration.ts).
  */
 export const DEFAULT_HALF_LIFE_DAYS = 365;

package/dist/multihop.d.ts

@@ -1,5 +1,5 @@
 import type { MemoryEntry } from './memory.js';
-import type { ResultCost, SearchResult } from './search/types.js';
+import { type ResultCost, type SearchResult } from './search/types.js';
 export declare function multihopSearch(query: string, entries: MemoryEntry[], options?: {
     budget?: number;
     now?: Date;

package/dist/multihop.js

@@ -1,7 +1,8 @@
 import { fitBudget } from './search/finalize.js';
 import { search } from './search/bm25-search.js';
+import { DEFAULT_RECALL_BUDGET } from './search/types.js';
 export function multihopSearch(query, entries, options = {}) {
-    const budget = options.budget ?? 4000;
+    const budget = options.budget ?? DEFAULT_RECALL_BUDGET;
     // Pass 1 searches wide to find entities, so each return fits the caller's budget, as search() does.
     const fit = (ordered) => fitBudget(ordered, budget, options.minResults ?? 1, options.cost);
     const pass1 = search(query, entries, { ...options, budget: budget * 2 });
@@ -31,7 +32,7 @@ export function multihopSearch(query, entries, options = {}) {
             merged.set(r.entry.id, r);
         }
     }
-    // T2 note: PLAIN stable score sort on purpose -- pass1/pass2 inputs are
+    // PLAIN stable score sort on purpose -- pass1/pass2 inputs are
     // deterministically ordered (search() carries the content tail), stability
     // inherits that, and ties keep pass-1 results ahead of pass-2 follow-ups.
     return fit([...merged.values()].sort((a, b) => b.score - a.score));

package/dist/owner-validation.d.ts

@@ -1,14 +1,13 @@
 /**
- * --owner format validation (B2 v1.12.6).
+ * --owner format validation.
  *
  * Documented MEMORY_ENVELOPE.md contract: owner = `user:<id>` | `agent:<id>`
- * with id ∈ `[A-Za-z0-9_-]+`. Pre-v1.12.6 any string was accepted, leaving
- * the documented contract unenforced.
+ * with id ∈ `[A-Za-z0-9_-]+`.
  *
  * Default: WARN-ONLY (log + accept) to preserve back-compat with existing
  * scripted callers passing legacy owner strings. Set `HIPPO_STRICT_OWNER=1`
- * to reject + exit. Strict mode will become the default once A5 v2 lands
- * (see `TODOS.md` A3 follow-ups for the migration path).
+ * to reject + exit. Strict mode will become the default once real auth replaces
+ * the stub (see `TODOS.md` for the migration path).
  */
 export declare const OWNER_RE: RegExp;
 export declare const OWNER_CONTRACT_HINT = "Must match ^(user|agent):[A-Za-z0-9_-]+$ (e.g. user:alice, agent:capture-bot).";

package/dist/owner-validation.js

@@ -1,14 +1,13 @@
 /**
- * --owner format validation (B2 v1.12.6).
+ * --owner format validation.
  *
  * Documented MEMORY_ENVELOPE.md contract: owner = `user:<id>` | `agent:<id>`
- * with id ∈ `[A-Za-z0-9_-]+`. Pre-v1.12.6 any string was accepted, leaving
- * the documented contract unenforced.
+ * with id ∈ `[A-Za-z0-9_-]+`.
  *
  * Default: WARN-ONLY (log + accept) to preserve back-compat with existing
  * scripted callers passing legacy owner strings. Set `HIPPO_STRICT_OWNER=1`
- * to reject + exit. Strict mode will become the default once A5 v2 lands
- * (see `TODOS.md` A3 follow-ups for the migration path).
+ * to reject + exit. Strict mode will become the default once real auth replaces
+ * the stub (see `TODOS.md` for the migration path).
  */
 import { processEnv } from './env.js';
 export const OWNER_RE = /^(user|agent):[A-Za-z0-9_-]+$/;