hippo-memory 1.61.0 → 1.63.0

package/dist/physics.d.ts

@@ -52,7 +52,7 @@ export declare function computeMass(strength: number, retrievalCount: number): n
 export declare function computeCharge(valence: EmotionalValence): number;
 export declare function computeTemperature(ageDays: number, temperatureDecay: number): number;
 /**
- * F1: Query gravity (retrieval-time, virtual — does not update position).
+ * Query gravity (retrieval-time, virtual — does not update position).
  * Returns scalar force magnitude for ranking.
  *
  * F_query(i) = G_Q * mass(i) * max(0, cosine(pos_i, query))^2
@@ -64,7 +64,7 @@ export declare function queryGravityMagnitude(particle: PhysicsParticle, queryEm
  */
 export declare function velocityAlignmentBonus(particle: PhysicsParticle, queryEmbedding: number[]): number;
 /**
- * F2: Inter-memory attraction force vector (consolidation-time).
+ * Inter-memory attraction force vector (consolidation-time).
  * Attractive force from particle j on particle i.
  *
  * F_attract(i,j) = G_M * m_i * m_j * max(0, cosine(i,j))^3 * direction(j→i in embedding space)
@@ -74,7 +74,7 @@ export declare function velocityAlignmentBonus(particle: PhysicsParticle, queryE
  */
 export declare function attractionForce(pi: PhysicsParticle, pj: PhysicsParticle, G_memory: number): number[];
 /**
- * F3: Conflict repulsion force vector (consolidation-time).
+ * Conflict repulsion force vector (consolidation-time).
  * Repulsive force pushing i away from j.
  *
  * F_repel(i,j) = K_R * m_i * m_j / max(0.01, cosine_distance(i,j))^2
@@ -82,7 +82,7 @@ export declare function attractionForce(pi: PhysicsParticle, pj: PhysicsParticle
  */
 export declare function repulsionForce(pi: PhysicsParticle, pj: PhysicsParticle, K_repulsion: number): number[];
 /**
- * F4: Drag force vector (consolidation-time).
+ * Drag force vector (consolidation-time).
  * F_drag(i) = -drag * velocity(i) / max(1, effective_half_life(i))
  *
  * effectiveHalfLife should be passed in from the memory's current half_life_days.

package/dist/physics.js

@@ -79,11 +79,9 @@ const CHARGE_MAP = {
     critical: -1.0,
 };
 export function computeMass(strength, retrievalCount) {
-    // EVAL-ONLY ablation (see ablation.ts): under the recall-boost flag, particle
-    // mass must not scale with retrieval history either - query gravity ranks by
-    // mass, so prior retrieval counts would leak strengthening into the ablated
-    // arm's physics-pool rankings (codex P2). Covers both the init and refresh
-    // callers in physics-state.ts.
+    // EVAL-ONLY ablation (see ablation.ts): under the recall-boost flag mass ignores retrieval history, since
+    // query gravity ranks by mass and prior counts would leak strengthening into the ablated arm's
+    // physics-pool rankings. Covers both the init and refresh callers in physics-state.ts.
     const effectiveCount = isRecallBoostAblated() ? 0 : retrievalCount;
     return Math.max(0.01, strength * (1 + 0.1 * Math.log2(effectiveCount + 1)));
 }
@@ -97,7 +95,7 @@ export function computeTemperature(ageDays, temperatureDecay) {
 // Force computations
 // ---------------------------------------------------------------------------
 /**
- * F1: Query gravity (retrieval-time, virtual — does not update position).
+ * Query gravity (retrieval-time, virtual — does not update position).
  * Returns scalar force magnitude for ranking.
  *
  * F_query(i) = G_Q * mass(i) * max(0, cosine(pos_i, query))^2
@@ -121,7 +119,7 @@ export function velocityAlignmentBonus(particle, queryEmbedding) {
     return Math.max(0, alignment);
 }
 /**
- * F2: Inter-memory attraction force vector (consolidation-time).
+ * Inter-memory attraction force vector (consolidation-time).
  * Attractive force from particle j on particle i.
  *
  * F_attract(i,j) = G_M * m_i * m_j * max(0, cosine(i,j))^3 * direction(j→i in embedding space)
@@ -139,7 +137,7 @@ export function attractionForce(pi, pj, G_memory) {
     return vecScale(direction, magnitude);
 }
 /**
- * F3: Conflict repulsion force vector (consolidation-time).
+ * Conflict repulsion force vector (consolidation-time).
  * Repulsive force pushing i away from j.
  *
  * F_repel(i,j) = K_R * m_i * m_j / max(0.01, cosine_distance(i,j))^2
@@ -154,7 +152,7 @@ export function repulsionForce(pi, pj, K_repulsion) {
     return vecScale(direction, magnitude);
 }
 /**
- * F4: Drag force vector (consolidation-time).
+ * Drag force vector (consolidation-time).
  * F_drag(i) = -drag * velocity(i) / max(1, effective_half_life(i))
  *
  * effectiveHalfLife should be passed in from the memory's current half_life_days.

package/dist/policies.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 policy first-class object (docs/plans/2026-05-30-e2-policy-object.md).
+ * Policy first-class object.
  *
  * The "bi-temporal-first" object type: a named rule/statement that is in force
  * over an EFFECTIVE-TIME range and evolves via supersession. Two time axes:
@@ -30,8 +30,8 @@
  * loadPoliciesAsOf's asOfDate) is normalized to canonical ISO-8601 datetime
  * (`toISOString`) at the store boundary BEFORE any persist or compare, so the
  * fixed-width values sort lexically and the half-open [valid_from, valid_to)
- * comparison is correct (plan-eng-critic round-1 CRIT fix: a date-only asOf vs a
- * datetime valid_from otherwise made a same-day policy invisible).
+ * comparison is correct (a date-only asOf vs a datetime valid_from would
+ * otherwise make a same-day policy invisible).
  *
  * Dual-write atomicity: `savePolicy` writes the memory + policies row (and, on
  * supersede, the predecessor's UPDATE) inside writeEntry's SAVEPOINT.
@@ -129,21 +129,20 @@ export declare function loadActivePolicies(hippoRoot: string, tenantId: string,
  *  - `superseded` rows that cover T BUT whose successor was not yet effective at T
  *    (successor.valid_from > asOf) - i.e. an earlier version that was genuinely in
  *    force then. This is the core valid-time correctness: a Jan-Jun policy
- *    superseded in May is still the answer for `asof March`. (codex review
- *    2026-05-30, P2 #2: filtering on status='active' alone dropped historically-
- *    valid superseded versions, conflating transaction-time with valid-time. The
- *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.)
+ *    superseded in May is still the answer for `asof March`. Filtering on
+ *    status='active' alone would conflate transaction-time with valid-time; the
+ *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.
  *
  * `closed` rows are EXCLUDED: closing is a deliberate transaction-time retirement,
  * and resurrecting closed policies for a historical valid-time is full
  * transaction-time-travel (deferred). Returns an ARRAY (overlapping same-name
  * ranges are allowed in v1). Optionally filtered to one policy_name.
  *
- * Date-only `asOfDate` (e.g. "2026-05-30", no time component) resolves to the END
+ * Date-only `asOfDate` (YYYY-MM-DD, no time component) resolves to the END
  * of that UTC day (23:59:59.999Z), so "as of [day D]" includes a policy that
  * became effective at any instant during D - this is the read-side fix for the
- * common create-then-asof-today workflow, keeping the stored valid_from honest
- * (codex review 2026-05-30). A full datetime asOf is used as the precise instant.
+ * common create-then-asof-today workflow, keeping the stored valid_from honest.
+ * A full datetime asOf is used as the precise instant.
  */
 export declare function loadPoliciesAsOf(hippoRoot: string, tenantId: string, asOfDate: string, opts?: {
     name?: string;

package/dist/policies.js

@@ -1,5 +1,5 @@
 /**
- * E2 policy first-class object (docs/plans/2026-05-30-e2-policy-object.md).
+ * Policy first-class object.
  *
  * The "bi-temporal-first" object type: a named rule/statement that is in force
  * over an EFFECTIVE-TIME range and evolves via supersession. Two time axes:
@@ -30,8 +30,8 @@
  * loadPoliciesAsOf's asOfDate) is normalized to canonical ISO-8601 datetime
  * (`toISOString`) at the store boundary BEFORE any persist or compare, so the
  * fixed-width values sort lexically and the half-open [valid_from, valid_to)
- * comparison is correct (plan-eng-critic round-1 CRIT fix: a date-only asOf vs a
- * datetime valid_from otherwise made a same-day policy invisible).
+ * comparison is correct (a date-only asOf vs a datetime valid_from would
+ * otherwise make a same-day policy invisible).
  *
  * Dual-write atomicity: `savePolicy` writes the memory + policies row (and, on
  * supersede, the predecessor's UPDATE) inside writeEntry's SAVEPOINT.
@@ -111,9 +111,79 @@ function buildPolicyContent(policyName, policyText, validFrom, validTo) {
     const range = validTo ? `${validFrom} to ${validTo}` : `${validFrom} onward`;
     return `${policyName}\n\n${policyText}\n\nEffective: ${range}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveProcess / saveDecision.
+function preflightPolicySupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no policy/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM policies WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`savePolicy: policy ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`savePolicy: policy ${supersedesId} is not active (status='${pred.status}'); only active policies can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertPolicyRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO policies(
+      memory_id, tenant_id, policy_name, policy_text, valid_from, valid_to,
+      version, status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.policyName, w.policyText, w.validFrom, w.validTo, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedePolicyRow(db, w, supersedesId, policyId, version) {
+    const sup = db.prepare(`
+    UPDATE policies
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(policyId, w.now, supersedesId, w.tenantId, policyId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`savePolicy: policy ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'policy_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            policy_id: supersedesId,
+            superseded_by: policyId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writePolicyRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightPolicySupersede(db, w.tenantId, w.supersedesId) : 1;
+    const policyId = insertPolicyRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedePolicyRow(db, w, w.supersedesId, policyId, version);
+    // SAFETY: SELECT ${POLICY_COLS} projects exactly the PolicyRow columns;
+    // .get() returns that row, or undefined only if the just-inserted id can't
+    // be found.
+    const row = db.prepare(`SELECT ${POLICY_COLS} FROM policies WHERE id = ?`)
+        .get(policyId);
+    if (!row)
+        throw new Error('savePolicy: failed to reload saved policy row');
+    // GDPR-light metadata: ids + flags only, no policy text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'policy_create',
+        targetId: String(policyId),
+        metadata: {
+            policy_id: policyId,
+            version,
+            open_ended: w.validTo === null,
+        },
+    });
+    return row;
+}
 /**
  * Create a policy (or a new version that supersedes an existing one). Writes the
  * memory mirror + the policies row atomically inside writeEntry's SAVEPOINT.
@@ -136,8 +206,7 @@ export function savePolicy(hippoRoot, tenantId, opts, actor = 'cli') {
     // (a date-only asOf resolves to end-of-day in loadPoliciesAsOf), NOT by
     // backdating the stored valid_from - backdating to midnight would make an
     // earlier-same-day as-of wrongly report the policy already in force and would
-    // hide a superseded predecessor for that earlier time (codex review
-    // 2026-05-30 round 2). An explicit --from is honored as-is.
+    // hide a superseded predecessor for that earlier time. An explicit --from is honored as-is.
     const { validFrom, validTo } = validatePolicyDates(opts.validFrom, opts.validTo, now);
     const isSupersede = opts.supersedesPolicyId !== undefined;
     const changeSummary = isSupersede ? (opts.changeSummary ?? null) : null;
@@ -151,75 +220,22 @@ export function savePolicy(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId,
+        actor,
+        policyName: opts.policyName,
+        policyText: opts.policyText,
+        validFrom,
+        validTo,
+        changeSummary,
+        supersedesId: opts.supersedesPolicyId,
+        now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveProcess / saveDecision (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesPolicyId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no policy/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM policies WHERE id = ? AND tenant_id = ?`).get(opts.supersedesPolicyId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`savePolicy: policy ${opts.supersedesPolicyId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`savePolicy: policy ${opts.supersedesPolicyId} is not active (status='${pred.status}'); only active policies can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO policies(
-          memory_id, tenant_id, policy_name, policy_text, valid_from, valid_to,
-          version, status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, opts.policyName, opts.policyText, validFrom, validTo, version, changeSummary, now);
-            const policyId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesPolicyId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE policies
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(policyId, now, opts.supersedesPolicyId, tenantId, policyId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`savePolicy: policy ${opts.supersedesPolicyId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'policy_supersede',
-                    targetId: String(opts.supersedesPolicyId),
-                    metadata: {
-                        policy_id: opts.supersedesPolicyId,
-                        superseded_by: policyId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${POLICY_COLS} projects exactly the PolicyRow columns;
-            // .get() returns that row, or undefined only if the just-inserted id can't
-            // be found.
-            const row = db.prepare(`SELECT ${POLICY_COLS} FROM policies WHERE id = ?`)
-                .get(policyId);
-            if (!row)
-                throw new Error('savePolicy: failed to reload saved policy row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no policy text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'policy_create',
-                targetId: String(policyId),
-                metadata: {
-                    policy_id: policyId,
-                    version,
-                    open_ended: validTo === null,
-                },
-            });
+            savedRow = writePolicyRow(db, memoryId, w);
         },
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
     });
@@ -273,7 +289,7 @@ export function closePolicy(hippoRoot, tenantId, id, actor = 'cli') {
             // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
             // not only via an enqueued rebuild whose queue item is lost if the mirror is later
             // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget (codex P1). Still enqueue when a mirror exists
+            // object stale and could block that forget. Still enqueue when a mirror exists
             // so a concurrent rebuild re-derives consistently (harmless if it also runs).
             removeGraphEntitiesForObject(hippoRoot, tenantId, 'policy', closed.id);
             if (closed.memoryId) {
@@ -359,21 +375,20 @@ export function loadActivePolicies(hippoRoot, tenantId, opts = {}) {
  *  - `superseded` rows that cover T BUT whose successor was not yet effective at T
  *    (successor.valid_from > asOf) - i.e. an earlier version that was genuinely in
  *    force then. This is the core valid-time correctness: a Jan-Jun policy
- *    superseded in May is still the answer for `asof March`. (codex review
- *    2026-05-30, P2 #2: filtering on status='active' alone dropped historically-
- *    valid superseded versions, conflating transaction-time with valid-time. The
- *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.)
+ *    superseded in May is still the answer for `asof March`. Filtering on
+ *    status='active' alone would conflate transaction-time with valid-time; the
+ *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.
  *
  * `closed` rows are EXCLUDED: closing is a deliberate transaction-time retirement,
  * and resurrecting closed policies for a historical valid-time is full
  * transaction-time-travel (deferred). Returns an ARRAY (overlapping same-name
  * ranges are allowed in v1). Optionally filtered to one policy_name.
  *
- * Date-only `asOfDate` (e.g. "2026-05-30", no time component) resolves to the END
+ * Date-only `asOfDate` (YYYY-MM-DD, no time component) resolves to the END
  * of that UTC day (23:59:59.999Z), so "as of [day D]" includes a policy that
  * became effective at any instant during D - this is the read-side fix for the
- * common create-then-asof-today workflow, keeping the stored valid_from honest
- * (codex review 2026-05-30). A full datetime asOf is used as the precise instant.
+ * common create-then-asof-today workflow, keeping the stored valid_from honest.
+ * A full datetime asOf is used as the precise instant.
  */
 export function loadPoliciesAsOf(hippoRoot, tenantId, asOfDate, opts = {}) {
     assertTenantId('loadPoliciesAsOf', tenantId);

package/dist/postinstall.js

@@ -7,12 +7,9 @@ function main() {
     if (envSkipPostinstall())
         return;
     try {
-        // Repair-only: re-ensure the wrapper for users who previously opted in
-        // (e.g. a Codex update restored the real binary over our shim). A first
-        // install never happens here — swapping the codex binary from a package
-        // postinstall is a consent violation and reads as binary hijacking to
-        // supply-chain scanners (issue #133). First install is `hippo hook
-        // install codex` only.
+        // Repair-only, for users who opted in (a Codex update can restore the real binary over our shim).
+        // Swapping the binary from postinstall is a consent violation that supply-chain scanners read as
+        // hijacking, so first install is `hippo hook install codex` only.
         repairCodexWrapperIfInstalled();
     }
     catch {

package/dist/predictions/planning-fallacy.d.ts

@@ -1,13 +1,11 @@
 /**
- * J3.2 surface delivered on `RecallResult.planningFallacyHint` when an
+ * Surface delivered on `RecallResult.planningFallacyHint` when an
  * agent's recall query carries a forward-prediction phrase AND the closest
  * matching prediction class has closed historical data.
  *
  * The agent sees its track record at the moment of forecasting, anchoring
  * on the outside view (Lovallo-Kahneman 2003) rather than the inside-view
  * inside the planning fallacy.
- *
- * Plan: docs/plans/2026-05-26-j32-auto-injection.md.
  */
 export interface PlanningFallacyHint {
     classTag: string;
@@ -25,13 +23,11 @@ export interface PlanningFallacyHint {
     meanRatio: number | null;
 }
 /**
- * v1.13.4 / J3.2 follow-up — "watching" variant emitted when the
- * forward-claim regex matched but no PlanningFallacyHint baserate was
- * returned. Dogfood diary (docs/dogfood/2026-05-27-track-j-warnings.md)
- * Trial 2a confirmed the pre-v1.13.4 silent paths were the most common
- * real-world J3.2 failure mode: a natural-language query carries a
+ * "Watching" variant emitted when the forward-claim regex matched but no
+ * PlanningFallacyHint baserate was returned. Silence was the most common
+ * real-world failure: a natural-language query carries a
  * forward-claim phrase but its non-stopword tokens don't overlap with
- * any prediction class tag, so hippo silently emitted nothing despite
+ * any prediction class tag, so hippo emitted nothing despite
  * the regex match. The watching variant surfaces the detection event
  * + a one-line suggestion so the agent can either re-tag the prediction
  * or pass the suggestion through to the user.
@@ -48,7 +44,7 @@ export interface PlanningFallacyWatching {
     suggestion: string;
 }
 /**
- * v1.13.4 / J3.2 follow-up — richer return type for
+ * Richer return type for
  * `computePlanningFallacyOutput`. Carries EITHER `hint` (baserate
  * available) OR `watching` (regex fired, no baserate), or NEITHER (mode=off,
  * no queryText, no regex match, or nClosed=0 silent path). Never both.
@@ -71,7 +67,7 @@ export interface ComputePlanningFallacyHintOpts {
     actor?: string;
 }
 /**
- * J3.2 orchestrator.
+ * Planning-fallacy orchestrator.
  *
  * Composes the forward-claim detector + class resolver + baserate compute,
  * with telemetry-grade audit emission at every decision point (success,
@@ -83,7 +79,7 @@ export interface ComputePlanningFallacyHintOpts {
  *   - no forward-claim regex match
  *   - resolved class has nClosed=0 (no historical data yet; silent)
  *
- * Returns `{ watching: ... }` on (v1.13.4 NEW — was silent null pre-1.13.4):
+ * Returns `{ watching: ... }` on:
  *   - resolver returns no class (no overlap ≥ 1; emits no_class_match audit)
  *   - resolver returns tiebreak (≥2 classes tied at best; emits tiebreak audit)
  *
@@ -93,8 +89,7 @@ export interface ComputePlanningFallacyHintOpts {
  * audit carries n_closed + mean_ratio in metadata so no telemetry is lost),
  * then emits recall_autodebias_hint audit + returns the hint.
  *
- * Latency budget (plan §Latency): ~50us regex-only on miss; ~750-850us
- * on full match+resolve+baserate path. Well under 50ms target.
+ * Latency budget: well under 50ms; a miss pays only the regex.
  */
 export declare function computePlanningFallacyOutput(hippoRoot: string, tenantId: string, queryText: string, opts?: ComputePlanningFallacyHintOpts): PlanningFallacyOutput;
 //# sourceMappingURL=planning-fallacy.d.ts.map

package/dist/predictions/planning-fallacy.js

@@ -11,8 +11,8 @@ import { computePredictionBaserate } from './store.js';
  * Indexed via idx_predictions_tenant_class (db.ts:1015) → O(log n) seek
  * plus a small DISTINCT scan over the per-tenant class-tag set.
  *
- * Scope behaviour (v1 design choice, independent-review-critic round 1
- * MED): class_tag selection is TENANT-GLOBAL, NOT scope-filtered against
+ * Scope behaviour (deliberate): class_tag selection is TENANT-GLOBAL,
+ * NOT scope-filtered against
  * the recall's opts.scope. The class_tag is an aggregator label across
  * historical predictions in the class, not a per-memory scope-bound
  * property. A no-scope recall CAN surface a class_tag from a privately-
@@ -75,7 +75,7 @@ function resolveClassFromTokens(hippoRoot, tenantId, queryTokens) {
     }
 }
 /**
- * J3.2 orchestrator.
+ * Planning-fallacy orchestrator.
  *
  * Composes the forward-claim detector + class resolver + baserate compute,
  * with telemetry-grade audit emission at every decision point (success,
@@ -87,7 +87,7 @@ function resolveClassFromTokens(hippoRoot, tenantId, queryTokens) {
  *   - no forward-claim regex match
  *   - resolved class has nClosed=0 (no historical data yet; silent)
  *
- * Returns `{ watching: ... }` on (v1.13.4 NEW — was silent null pre-1.13.4):
+ * Returns `{ watching: ... }` on:
  *   - resolver returns no class (no overlap ≥ 1; emits no_class_match audit)
  *   - resolver returns tiebreak (≥2 classes tied at best; emits tiebreak audit)
  *
@@ -97,8 +97,7 @@ function resolveClassFromTokens(hippoRoot, tenantId, queryTokens) {
  * audit carries n_closed + mean_ratio in metadata so no telemetry is lost),
  * then emits recall_autodebias_hint audit + returns the hint.
  *
- * Latency budget (plan §Latency): ~50us regex-only on miss; ~750-850us
- * on full match+resolve+baserate path. Well under 50ms target.
+ * Latency budget: well under 50ms; a miss pays only the regex.
  */
 export function computePlanningFallacyOutput(hippoRoot, tenantId, queryText, opts = {}) {
     // Env read FIRST so AUTODEBIAS=off pays zero regex cost. Per-call read
@@ -115,19 +114,14 @@ export function computePlanningFallacyOutput(hippoRoot, tenantId, queryText, opt
     const actor = opts.actor ?? 'recall';
     const resolution = resolveClassFromTokens(hippoRoot, tenantId, match.classQueryTokens);
     if (resolution.tiebreak) {
-        // Telemetry: forward-claim detected, ≥2 classes tied at best overlap.
-        // v1.13.4: now ALSO returns a watching variant so the caller surface
-        // can render a "watching but no baserate (tiebreak)" line. Audit emission
-        // unchanged (the audit channel is the telemetry-grade source of truth).
+        // Telemetry: forward-claim detected, ≥2 classes tied at best overlap. The watching variant lets the
+        // caller render "watching but no baserate (tiebreak)"; the audit channel stays the source of truth.
         return watchingWithAudit(hippoRoot, tenantId, actor, match, 'tiebreak', TIEBREAK_SUGGESTION);
     }
     if (!resolution.classTag) {
-        // Telemetry: forward-claim detected, no class scored ≥ 1.
-        // This is the channel that drives the embedding-fallback decision
-        // for J3.3 — high volume here = regex+token-overlap is missing
-        // legitimate forward-claims that have NO obvious class signal.
-        // v1.13.4: now ALSO returns a watching variant so the caller surface
-        // can render a "watching but no baserate (no class match)" line.
+        // Telemetry: forward-claim detected, no class scored ≥ 1. High volume here means regex+token-overlap
+        // misses real forward-claims with no class signal, the case for an embedding fallback.
+        // The watching variant lets the caller render "watching but no baserate (no class match)".
         return watchingWithAudit(hippoRoot, tenantId, actor, match, 'no_class_match', NO_CLASS_MATCH_SUGGESTION);
     }
     // emitAudit=false: avoid double-write to predict_baserate channel.

package/dist/predictions/store.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 prediction first-class object (v0.31 / docs/plans/2026-05-26-e2-prediction-object.md).
+ * Prediction first-class object.
  *
  * Canonical store for ex-ante claims that can be closed against ex-post
  * outcomes. The `predictions` table holds every field (including
@@ -19,10 +19,8 @@
  * a failure in either step rolls back both. Pattern matches supersede
  * (api.ts:1486) and the Slack/GitHub connectors.
  *
- * J3 (reference-class / planning-fallacy detector) reads from
- * `loadPredictionsByClass` to compute per-class base rates from
- * (estimate_value, actual_value) at query time. J3 is a follow-up episode;
- * this module ships the data layer.
+ * The planning-fallacy detector reads `loadPredictionsByClass` and computes
+ * per-class base rates from (estimate_value, actual_value) at query time.
  */
 import { type KeysetPosition } from '../keyset.js';
 export type ClosureState = 'open' | 'closed' | 'closed-unknown';
@@ -71,18 +69,22 @@ export interface ListPredictionsOpts {
  * The memory is tagged `['prediction', classTag]` with `source='prediction'`
  * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
  * see open predictions naturally; the predictions table is the canonical
- * structured store used by J3.
+ * structured store used by the planning-fallacy detector.
  */
 export declare function savePrediction(hippoRoot: string, tenantId: string, opts: SavePredictionOpts, actor?: string): Prediction;
 /**
  * Close an existing open prediction. Updates the predictions row only;
  * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * J3 computes accuracy (clean vs regressed) from (estimateValue,
- * actualValue) at query time.
+ * Accuracy is computed from (estimateValue, actualValue) at query time.
  */
 export declare function closePrediction(hippoRoot: string, tenantId: string, id: number, opts: ClosePredictionOpts, actor?: string): Prediction;
 export declare function loadPredictionById(hippoRoot: string, tenantId: string, id: number): Prediction | null;
 export declare function loadPredictionsByClass(hippoRoot: string, tenantId: string, classTag: string, opts?: ListPredictionsOpts): Prediction[];
+/** Every prediction in the tenant, open and closed, across all classes: the `status=all` list without a class. */
+export declare function loadAllPredictions(hippoRoot: string, tenantId: string, opts?: {
+    limit?: number;
+    after?: KeysetPosition;
+}): Prediction[];
 export interface PredictionBaserate {
     classTag: string;
     /** Count of closed predictions with a numeric actual_value (excludes
@@ -105,28 +107,18 @@ export interface PredictionBaserate {
     summary: string;
 }
 /**
- * Compute base-rate stats for closed predictions in a class. Used by J3
- * reference-class / planning-fallacy detector. Direct application of
- * Lovallo-Kahneman (2003) inside-vs-outside view.
+ * Compute base-rate stats for closed predictions in a class for the
+ * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
  *
  * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
  * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
  * compare against) and open (not yet resolved).
  *
- * Audit-emit is BUILT IN here (single source of truth, no caller-site
- * drift risk). Plan-eng-critic round 1 HIGH recommendation: emit inside
- * helper, not at 3 call sites.
+ * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
  */
 export declare function computePredictionBaserate(hippoRoot: string, tenantId: string, classTag: string, actor?: string, 
-/** v0.32 / J3.2 — when false, skip the predict_baserate audit emit. The
- *  J3.2 orchestrator (computePlanningFallacyOutput, below) calls this with
- *  emitAudit=false and emits its own `recall_autodebias_hint` audit row
- *  instead, so the predict_baserate channel stays scoped to deliberate
- *  CLI / HTTP / MCP predict-baserate calls and does NOT pollute on every
- *  recall containing a forward-claim phrase. Default true preserves the
- *  v1.13.0 J3 audit semantics for the 3 direct callers (cmdPredict
- *  baserate, /v1/predictions/stats route, hippo_predict_baserate MCP
- *  handler) — none of them pass this argument. */
+/** False skips the predict_baserate audit so that channel only records deliberate
+ *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
 emitAudit?: boolean): PredictionBaserate;
 export declare function loadOpenPredictions(hippoRoot: string, tenantId: string, opts?: {
     classTag?: string;