hippo-memory 1.61.0 → 1.63.0

package/dist/recall-history.d.ts

@@ -1,21 +1,20 @@
 /**
- * J1 anchoring detector (recall-recurrence) — pure module.
+ * Anchoring detector (recall-recurrence), pure module.
  *
- * Implements two detection rules from ROADMAP-RESEARCH.md L546:
- *   R1 query_repeat: same queryHash within recentRepeatWindow returned
+ * Implements two detection rules:
+ *   query_repeat: same queryHash within recentRepeatWindow returned
  *     same topMemoryId (caller is re-asking the same question).
- *   R2 memory_dominance: same topMemoryId across >= minDominance distinct
+ *   memory_dominance: same topMemoryId across >= minDominance distinct
  *     queryHashes (memory acts as a fixed-point anchor regardless of what
  *     the agent asks).
  *
- * Per the plan v3 architectural decision: each pipeline (api.recall via
+ * Each pipeline (api.recall via
  * HTTP, cmdRecall, MCP hippo_recall) owns its OWN ring buffer Map keyed
  * by (tenant, session). No cross-pipeline sharing (the typical multi-
  * process deployment makes IPC ring-sharing impractical; per-pipeline
  * is correct because each pipeline has its own top-1 ranking anyway).
  *
- * Plan: docs/plans/2026-05-26-j1-anchoring-detector.md.
- * Composes with J3.2: AnchoringHint + PlanningFallacyHint are independent
+ * AnchoringHint + PlanningFallacyHint are independent
  * signals; both can fire on the same recall.
  */
 export type AnchoringReason = 'query_repeat' | 'memory_dominance';
@@ -36,20 +35,20 @@ export interface RecallHistoryEntry {
     queryHash: number;
     /** Top-1 memory id this recall surfaced; null if zero results. */
     topMemoryId: string | null;
-    /** ISO-8601 timestamp; advisory, not used by R1/R2 logic. */
+    /** ISO-8601 timestamp; advisory, not used by the detection rules. */
     ts: string;
     /** Memory id of the AnchoringHint that fired on this recall, if any.
-     *  Used by R1/R2 cooldown logic to prevent re-emitting the same hint on
+     *  Used by the cooldown logic to prevent re-emitting the same hint on
      *  consecutive recalls within the dominance window. Caller-written
      *  AFTER detectAnchoring returns; reads next time detectAnchoring runs. */
     anchoredOn?: string;
 }
 export type RecallHistorySnapshot = readonly RecallHistoryEntry[];
 export interface DetectAnchoringOpts {
-    /** R2 threshold: number of distinct queryHashes that must have returned
+    /** memory_dominance threshold: number of distinct queryHashes that must have returned
      *  the same topMemoryId. Default 3. */
     minDominance?: number;
-    /** R1 window: how many recent history entries to scan for query repeat.
+    /** query_repeat window: how many recent history entries to scan for query repeat.
      *  Default 5. */
     recentRepeatWindow?: number;
     /** Cooldown: if the immediately-prior fire (per `anchoredOn`) was for
@@ -63,8 +62,8 @@ export interface DetectAnchoringOpts {
  * sort tokens → join → FNV-1a 32-bit.
  *
  * Token sort + dedup means semantically-equivalent queries with reordered
- * words collide intentionally (the roadmap's "semantically-distinct" v1
- * uses textual normalization; embedding-based distinctness is J1-v2).
+ * words collide intentionally ("semantically-distinct" is approximated by
+ * textual normalization, not embeddings).
  *
  * Deterministic across processes; stable across Node + V8 versions.
  */
@@ -73,17 +72,17 @@ export declare function hashQueryText(query: string): number;
  * Detect anchoring patterns in the recall history against the current
  * recall's (queryHash, topMemoryId).
  *
- * Rule precedence: R2 (memory_dominance) wins on tie. When both R1 and R2
- * fire on the same recall, return only the R2 hint — R2's signal is the
- * cognitively stronger one (a memory dominating multiple DIFFERENT queries
- * is a fixed-point anchor; R1 alone is just a literal re-ask).
+ * Rule precedence: memory_dominance wins on tie. When both rules fire on the
+ * same recall, return only memory_dominance, the stronger signal (a memory
+ * dominating multiple DIFFERENT queries is a fixed-point anchor; query_repeat
+ * alone is just a literal re-ask).
  *
  * Cooldown: if the immediately-prior recall fired a hint on the SAME
  * topMemoryId within `cooldown=3` history entries, suppress. Prevents
  * spam when the agent repeatedly recalls within the dominance window.
- * Cooldown is per-memory, not per-rule: if R2 fired on M (cooldown
- * engaged for M), and the next recall has top=N + repeated query →
- * R1 fires on N (different memory, not in cooldown).
+ * Cooldown is per-memory, not per-rule: if memory_dominance fired on M
+ * (cooldown engaged for M), and the next recall has top=N + repeated query,
+ * query_repeat fires on N (different memory, not in cooldown).
  *
  * @returns AnchoringHint when a pattern fires; null otherwise.
  */

package/dist/recall-history.js

@@ -1,21 +1,20 @@
 /**
- * J1 anchoring detector (recall-recurrence) — pure module.
+ * Anchoring detector (recall-recurrence), pure module.
  *
- * Implements two detection rules from ROADMAP-RESEARCH.md L546:
- *   R1 query_repeat: same queryHash within recentRepeatWindow returned
+ * Implements two detection rules:
+ *   query_repeat: same queryHash within recentRepeatWindow returned
  *     same topMemoryId (caller is re-asking the same question).
- *   R2 memory_dominance: same topMemoryId across >= minDominance distinct
+ *   memory_dominance: same topMemoryId across >= minDominance distinct
  *     queryHashes (memory acts as a fixed-point anchor regardless of what
  *     the agent asks).
  *
- * Per the plan v3 architectural decision: each pipeline (api.recall via
+ * Each pipeline (api.recall via
  * HTTP, cmdRecall, MCP hippo_recall) owns its OWN ring buffer Map keyed
  * by (tenant, session). No cross-pipeline sharing (the typical multi-
  * process deployment makes IPC ring-sharing impractical; per-pipeline
  * is correct because each pipeline has its own top-1 ranking anyway).
  *
- * Plan: docs/plans/2026-05-26-j1-anchoring-detector.md.
- * Composes with J3.2: AnchoringHint + PlanningFallacyHint are independent
+ * AnchoringHint + PlanningFallacyHint are independent
  * signals; both can fire on the same recall.
  */
 import { envAnchoringOff, envAvailabilityOff } from './env.js';
@@ -31,44 +30,27 @@ const DEFAULT_COOLDOWN = 3;
  * sort tokens → join → FNV-1a 32-bit.
  *
  * Token sort + dedup means semantically-equivalent queries with reordered
- * words collide intentionally (the roadmap's "semantically-distinct" v1
- * uses textual normalization; embedding-based distinctness is J1-v2).
+ * words collide intentionally ("semantically-distinct" is approximated by
+ * textual normalization, not embeddings).
  *
  * Deterministic across processes; stable across Node + V8 versions.
  */
 export function hashQueryText(query) {
     if (!query)
         return 0;
-    // Token dedup before join: the R2 contract says "distinct queries"
-    // means semantically distinct, so `foo bar` and `foo foo bar` should
-    // collapse to the same hash. Without dedup, simple phrasing
-    // variations (typos, doubled tokens, intensifiers) would inflate
-    // distinct-query counts and trip R2 on essentially the same question.
-    // Codex round-1 catch.
-    // Unicode-aware tokenization (codex round-3 P2 catch): the prior
-    // ASCII-only [^a-z0-9\s] pattern stripped every non-Latin letter, so
-    // Japanese, Arabic, Cyrillic, accented-Latin etc. queries collapsed
-    // to empty token set -> hash 0 -> false R1 collisions across distinct
-    // non-English queries. \p{L} = any Unicode letter, \p{N} = any Unicode
-    // number, \p{M} = combining marks (preserve composed accented chars).
-    // Requires the /u flag and Node >= 12.
+    // Tokens are deduped before join so `foo foo bar` and `foo bar` count as one query for memory_dominance.
+    // Unicode classes (\p{L} letter, \p{N} number, \p{M} combining mark; needs /u) keep
+    // non-Latin queries from collapsing to an empty token set and colliding at hash 0.
     const normalized = query
         .toLowerCase()
         .replace(/[^\p{L}\p{N}\p{M}\s]/gu, ' ')
         .split(/\s+/)
         .filter((t) => t.length > 0);
-    // Drop tokens shorter than 3 chars to match the normalizer contract
-    // (filler / stop words). Without this, `a login bug` vs `login bug`
-    // hash differently and inflate R2 distinct-query counts, firing
-    // memory_dominance on repeated phrasings of the same question.
-    // Codex round-4 P2 catch. Matches the same >=3 filter in
-    // src/forward-claim-detector.ts for class-resolver tokens.
+    // Drop tokens under 3 chars (filler words) so `a login bug` and `login bug` hash
+    // alike; matches the >=3 filter in src/forward-claim-detector.ts.
     const filtered = normalized.filter((t) => t.length >= 3);
-    // Fallback when the >=3 filter would collapse the entire query to
-    // empty: CJK queries like `测试` / `环境` are 2-char tokens; English
-    // acronyms like `AI` / `UI` are 2 chars. Without this fallback they
-    // all hash to fnv1a32(''), producing false R1 collisions across
-    // distinct short-token queries. Codex round-5 P2 catch.
+    // Fall back to all tokens when the filter empties the query (CJK 2-char words,
+    // acronyms like `AI`) so distinct short queries do not all hash to fnv1a32('').
     const tokens = filtered.length > 0 ? filtered : normalized;
     const deduped = Array.from(new Set(tokens)).sort();
     return fnv1a32(deduped.join(' '));
@@ -91,17 +73,17 @@ function fnv1a32(text) {
  * Detect anchoring patterns in the recall history against the current
  * recall's (queryHash, topMemoryId).
  *
- * Rule precedence: R2 (memory_dominance) wins on tie. When both R1 and R2
- * fire on the same recall, return only the R2 hint — R2's signal is the
- * cognitively stronger one (a memory dominating multiple DIFFERENT queries
- * is a fixed-point anchor; R1 alone is just a literal re-ask).
+ * Rule precedence: memory_dominance wins on tie. When both rules fire on the
+ * same recall, return only memory_dominance, the stronger signal (a memory
+ * dominating multiple DIFFERENT queries is a fixed-point anchor; query_repeat
+ * alone is just a literal re-ask).
  *
  * Cooldown: if the immediately-prior recall fired a hint on the SAME
  * topMemoryId within `cooldown=3` history entries, suppress. Prevents
  * spam when the agent repeatedly recalls within the dominance window.
- * Cooldown is per-memory, not per-rule: if R2 fired on M (cooldown
- * engaged for M), and the next recall has top=N + repeated query →
- * R1 fires on N (different memory, not in cooldown).
+ * Cooldown is per-memory, not per-rule: if memory_dominance fired on M
+ * (cooldown engaged for M), and the next recall has top=N + repeated query,
+ * query_repeat fires on N (different memory, not in cooldown).
  *
  * @returns AnchoringHint when a pattern fires; null otherwise.
  */
@@ -119,7 +101,7 @@ export function detectAnchoring(history, currentQueryHash, currentTopMemoryId, o
             return null;
         }
     }
-    // R2 check FIRST (wins on tie). Count distinct queryHashes in history
+    // memory_dominance check FIRST (wins on tie). Count distinct queryHashes in history
     // where topMemoryId === currentTopMemoryId (excluding null tops).
     const matchingQueryHashes = new Set();
     for (const entry of history) {
@@ -139,7 +121,7 @@ export function detectAnchoring(history, currentQueryHash, currentTopMemoryId, o
             source: 'j1-recurrence',
         };
     }
-    // R1 check: is currentQueryHash present in the last `recentRepeatWindow`
+    // query_repeat check: is currentQueryHash present in the last `recentRepeatWindow`
     // entries AND was that entry's topMemoryId === currentTopMemoryId?
     const r1Slice = history.slice(-recentRepeatWindow);
     for (const entry of r1Slice) {

package/dist/recall-pipeline.js

@@ -11,6 +11,7 @@ import { DEFAULT_GRAPH_STREAM_WEIGHT } from './graph-stream.js';
 import { Layer } from './memory.js';
 import { multihopSearch } from './multihop.js';
 import { passesCliRecallScopeFilter } from './recall-scope.js';
+import { currentEntries } from './search/as-of.js';
 import { hybridSearch } from './search/hybrid.js';
 import { physicsSearch } from './search/physics-search.js';
 import { searchBothHybrid } from './shared.js';
@@ -72,36 +73,11 @@ function loadRecallPool(ctx, opts) {
     const passes = (e) => passesCliRecallScopeFilter(e.scope ?? null, requested);
     local = local.filter(passes);
     global = global.filter(passes);
-    if (opts.asOf) {
-        local = currentAsOf(local, opts.asOf);
-        global = currentAsOf(global, opts.asOf);
-    }
-    else if (!opts.includeSuperseded) {
-        local = local.filter((e) => !e.superseded_by);
-        global = global.filter((e) => !e.superseded_by);
-    }
+    const currentness = { asOf: opts.asOf, includeSuperseded: opts.includeSuperseded };
+    local = currentEntries(local, currentness);
+    global = currentEntries(global, currentness);
     return { local, global, total, dropped: total - (local.length + global.length) };
 }
-/** Rows that were true at `asOf`: valid by then, and not yet replaced by a successor in the same pool. */
-function currentAsOf(entries, asOf) {
-    const asOfDate = new Date(asOf);
-    const successorValidFrom = new Map();
-    for (const e of entries) {
-        if (e.superseded_by) {
-            const successor = entries.find(s => s.id === e.superseded_by);
-            if (successor)
-                successorValidFrom.set(e.id, successor.valid_from);
-        }
-    }
-    return entries.filter(e => {
-        if (new Date(e.valid_from) > asOfDate)
-            return false;
-        if (!e.superseded_by)
-            return true;
-        const succVf = successorValidFrom.get(e.id);
-        return succVf ? new Date(succVf) > asOfDate : true;
-    });
-}
 async function searchPool(ctx, opts, pool) {
     const { query, budget, cost, includeSuperseded, asOf, activeScope: scope, search } = opts;
     const { mmr, mmrLambda, minResults, explain } = search;

package/dist/recall-scope.d.ts

@@ -1,8 +1,7 @@
 /**
- * v1.25.0 — recall-side scope predicates, extracted from api.ts into a leaf
- * module so shared.ts (which api.ts imports) can apply the same default-deny
- * rule to searchBothHybrid's internal candidate loads without an import
- * cycle. Mirrors the v39 `project-identity.ts` precedent. api.ts imports
+ * Recall-side scope predicates, in a leaf module so shared.ts (which api.ts
+ * imports) can apply the same default-deny rule to searchBothHybrid's internal
+ * candidate loads without an import cycle. api.ts imports
  * these for its own call sites AND re-exports them for back-compat
  * (`api.isPrivateScope`, test imports of `passesScopeFilterForRecall`).
  */
@@ -30,7 +29,7 @@ export declare const RECALL_DEFAULT_DENY_SCOPES: readonly ["unknown:legacy"];
  */
 export declare function assertNonEmpty<T>(arr: readonly T[], name: string): void;
 /**
- * v1.2.1: source-agnostic private-scope detector. A scope string is treated
+ * Source-agnostic private-scope detector. A scope string is treated
  * as private when it has the shape `<lowercase-source>:private:<rest>`.
  *
  * Examples that match:
@@ -56,14 +55,14 @@ export declare function isPrivateScope(scope: string | null | undefined): boolea
  *   `<source>:private:*` scope and on the `RECALL_DEFAULT_DENY_SCOPES`
  *   quarantine buckets. `null` and public scopes pass.
  *
- * @internal v1.7.2 — exported for test parity with
+ * @internal Exported for test parity with
  * `RECALL_DEFAULT_DENY_SCOPES` (single-source-of-truth verification). NOT part
  * of the public API surface; not re-exported from `src/index.ts`. Subject to
  * change without semver bump.
  */
 export declare function passesScopeFilterForRecall(scope: string | null, requested: string | undefined): boolean;
 /**
- * v1.25.0 — the CLI `--scope` variant of the recall filter (JS half of the
+ * The CLI `--scope` variant of the recall filter (JS half of the
  * SQL 'default-deny-or-exact' mode in loadSearchRows).
  *
  * The CLI flag predates the envelope column as a TAG-boost ranking hint
@@ -101,7 +100,7 @@ export interface ScopeActor {
 }
 /** True when `actor` may read `scope`: admin always; member needs an exact grant on a restricted scope. */
 export declare function canReadScope(actor: ScopeActor, scope: string): boolean;
-/** Authorize an explicitly requested scope before any read honours it (ROADMAP Part VIII EI2: member scope grants). */
+/** Authorize an explicitly requested scope before any read honours it (member scope grants). */
 export declare function assertScopeRequestAllowed(actor: ScopeActor, requested: string | undefined): void;
 /** Scope a derived row keeps from one source: the restricted scope itself, else null. */
 export declare function derivationScope(scope: string | null | undefined): string | null;

package/dist/recall-scope.js

@@ -1,8 +1,7 @@
 /**
- * v1.25.0 — recall-side scope predicates, extracted from api.ts into a leaf
- * module so shared.ts (which api.ts imports) can apply the same default-deny
- * rule to searchBothHybrid's internal candidate loads without an import
- * cycle. Mirrors the v39 `project-identity.ts` precedent. api.ts imports
+ * Recall-side scope predicates, in a leaf module so shared.ts (which api.ts
+ * imports) can apply the same default-deny rule to searchBothHybrid's internal
+ * candidate loads without an import cycle. api.ts imports
  * these for its own call sites AND re-exports them for back-compat
  * (`api.isPrivateScope`, test imports of `passesScopeFilterForRecall`).
  */
@@ -35,7 +34,7 @@ export function assertNonEmpty(arr, name) {
 }
 assertNonEmpty(RECALL_DEFAULT_DENY_SCOPES, 'RECALL_DEFAULT_DENY_SCOPES');
 /**
- * v1.2.1: source-agnostic private-scope detector. A scope string is treated
+ * Source-agnostic private-scope detector. A scope string is treated
  * as private when it has the shape `<lowercase-source>:private:<rest>`.
  *
  * Examples that match:
@@ -68,7 +67,7 @@ export function isPrivateScope(scope) {
  *   `<source>:private:*` scope and on the `RECALL_DEFAULT_DENY_SCOPES`
  *   quarantine buckets. `null` and public scopes pass.
  *
- * @internal v1.7.2 — exported for test parity with
+ * @internal Exported for test parity with
  * `RECALL_DEFAULT_DENY_SCOPES` (single-source-of-truth verification). NOT part
  * of the public API surface; not re-exported from `src/index.ts`. Subject to
  * change without semver bump.
@@ -80,7 +79,7 @@ export function passesScopeFilterForRecall(scope, requested) {
     return !isRestrictedScope(scope);
 }
 /**
- * v1.25.0 — the CLI `--scope` variant of the recall filter (JS half of the
+ * The CLI `--scope` variant of the recall filter (JS half of the
  * SQL 'default-deny-or-exact' mode in loadSearchRows).
  *
  * The CLI flag predates the envelope column as a TAG-boost ranking hint
@@ -135,7 +134,7 @@ export function canReadScope(actor, scope) {
         return true;
     return (actor.scopes ?? []).includes(scope);
 }
-/** Authorize an explicitly requested scope before any read honours it (ROADMAP Part VIII EI2: member scope grants). */
+/** Authorize an explicitly requested scope before any read honours it (member scope grants). */
 export function assertScopeRequestAllowed(actor, requested) {
     if (requested === undefined || requested === '')
         return;

package/dist/recall-trace.d.ts

@@ -1,6 +1,5 @@
 /**
- * LC1 — retrieval-trace persistence
- * (docs/plans/2026-08-02-lc1-recall-trace-persistence.md).
+ * Retrieval-trace persistence.
  *
  * Single producer for the `recall_traces` / `recall_trace_results` /
  * `recall_trace_outcomes` tables (schema v40). Every recall on the three
@@ -59,14 +58,11 @@ export declare function writeRecallTrace(db: DatabaseSyncLike, input: RecallTrac
  * Used at api.getContext and CLI cmdRecall — sites where the block's own
  * convention is per-call handles (writeEntry, saveIndex) and the earlier
  * audit handles are already closed. NOT used by api.recall, which must
- * reuse the caller's open handle (v1.11.5 no-side-effects contract,
+ * reuse the caller's open handle (no-side-effects contract,
  * tests/api-recall-no-side-effects.test.ts).
  *
- * F1 structural fix (replaces the earlier stamp-then-clear design): this
- * function does NOT touch the `last_trace_id` meta key. Stamping lived here
- * originally, on its own connection, separate from the `last_retrieval_ids`
- * write in `saveIndex` — two connections meant two commits, so a crash or
- * a failed second write could advance one without the other. LOCKSTEP
+ * This function does NOT touch the `last_trace_id` meta key: its own connection
+ * would commit apart from `saveIndex`, so a crash could advance one key alone. LOCKSTEP
  * INVARIANT: `last_trace_id` must only ever advance in the SAME write as
  * `last_retrieval_ids`. The caller now does: call this function FIRST, set
  * `localIndex.last_trace_id` from the returned id, THEN call `saveIndex`
@@ -98,7 +94,7 @@ export interface RecordTraceOutcomeInput {
  * Lives in its own append-only table, not audit_log metadata: audit_log is
  * pruned by `pruneAuditLog`, and pruning must never erase training data.
  *
- * F4 validation (codex cross-model finding): `traceId`/`memoryIds` reach
+ * Validation: `traceId`/`memoryIds` reach
  * this function from caller-side state (`last_trace_id` / applied outcome
  * ids) that can go stale relative to the trace it names — a forgotten
  * memory, a tenant switch mid-session, or a race between two callers. Two

package/dist/recall-trace.js

@@ -1,6 +1,5 @@
 /**
- * LC1 — retrieval-trace persistence
- * (docs/plans/2026-08-02-lc1-recall-trace-persistence.md).
+ * Retrieval-trace persistence.
  *
  * Single producer for the `recall_traces` / `recall_trace_results` /
  * `recall_trace_outcomes` tables (schema v40). Every recall on the three
@@ -21,7 +20,7 @@ import { DELIVERY_LEDGER_VERSION } from './delivery-recorder.js';
 import { log } from './log.js';
 /**
  * Strip a RerankStep down to {stage, multiplier, scoreBefore, scoreAfter}
- * before persisting (F3 privacy fix, codex cross-model finding). `note` is
+ * before persisting. `note` is
  * free-form human text — the CLI's goal-boost step embeds matched goal tag
  * text there, so persisting it verbatim would leak raw user content into
  * training data via `rerank_json`. Only the four structured fields survive;
@@ -89,14 +88,11 @@ export function writeRecallTrace(db, input) {
  * Used at api.getContext and CLI cmdRecall — sites where the block's own
  * convention is per-call handles (writeEntry, saveIndex) and the earlier
  * audit handles are already closed. NOT used by api.recall, which must
- * reuse the caller's open handle (v1.11.5 no-side-effects contract,
+ * reuse the caller's open handle (no-side-effects contract,
  * tests/api-recall-no-side-effects.test.ts).
  *
- * F1 structural fix (replaces the earlier stamp-then-clear design): this
- * function does NOT touch the `last_trace_id` meta key. Stamping lived here
- * originally, on its own connection, separate from the `last_retrieval_ids`
- * write in `saveIndex` — two connections meant two commits, so a crash or
- * a failed second write could advance one without the other. LOCKSTEP
+ * This function does NOT touch the `last_trace_id` meta key: its own connection
+ * would commit apart from `saveIndex`, so a crash could advance one key alone. LOCKSTEP
  * INVARIANT: `last_trace_id` must only ever advance in the SAME write as
  * `last_retrieval_ids`. The caller now does: call this function FIRST, set
  * `localIndex.last_trace_id` from the returned id, THEN call `saveIndex`
@@ -135,7 +131,7 @@ export function writeRecallTraceAtRoot(root, input) {
  * Lives in its own append-only table, not audit_log metadata: audit_log is
  * pruned by `pruneAuditLog`, and pruning must never erase training data.
  *
- * F4 validation (codex cross-model finding): `traceId`/`memoryIds` reach
+ * Validation: `traceId`/`memoryIds` reach
  * this function from caller-side state (`last_trace_id` / applied outcome
  * ids) that can go stale relative to the trace it names — a forgotten
  * memory, a tenant switch mid-session, or a race between two callers. Two

package/dist/refine-llm.d.ts

@@ -23,7 +23,7 @@ export interface RefineOptions {
     /** Injected for testing — defaults to the real fetch. */
     fetcher?: typeof fetch;
     /**
-     * L9: tenant scope. When provided, refineStore only scans consolidated
+     * Tenant scope. When provided, refineStore only scans consolidated
      * entries belonging to this tenant, and parent lookups are scoped to the
      * same tenant. Cross-tenant parents return null from readEntry and are
      * silently skipped (refine still produces output from merged content).

package/dist/refine-llm.js

@@ -109,7 +109,7 @@ export async function refineStore(hippoRoot, opts) {
         failed: 0,
         details: [],
     };
-    // L9: when opts.tenantId is provided, scope the top-level scan to this
+    // When opts.tenantId is provided, scope the top-level scan to this
     // tenant's consolidated entries.
     const entries = loadAllEntries(hippoRoot, opts.tenantId);
     let processed = 0;
@@ -130,7 +130,7 @@ export async function refineStore(hippoRoot, opts) {
         const sources = [];
         const parentIds = Array.isArray(entry.parents) ? entry.parents : [];
         for (const pid of parentIds) {
-            // L9: parent lookup scoped by opts.tenantId when provided.
+            // Parent lookup scoped by opts.tenantId when provided.
             // Cross-tenant parents return null and are silently skipped — refine
             // still produces output from the merged content alone (graceful
             // degradation rather than refuse-to-refine).

package/dist/reject-flow.d.ts

@@ -1,6 +1,5 @@
 /**
- * AT1 rejected-value tombstone — shared reject/unreject/list flow.
- * docs/plans/2026-08-15-at1-rejected-value-tombstone.md (T2, plan §4).
+ * Rejected-value tombstone: shared reject/unreject/list flow.
  *
  * The CLI (`hippo reject`/`rejections`/`unreject`) and the Context-based
  * `api.reject`/`api.unreject`/`api.listRejections` surfaces both need the
@@ -24,12 +23,12 @@ export interface RejectFlowOpts {
 }
 export interface RejectFlowResult {
     digest: string;
-    /** The rejected content, for the CLI's at-reject-time echo (plan §2: the
+    /** The rejected content, for the CLI's at-reject-time echo (the
      *  tombstone itself stores no content — this is the only place it's seen
      *  again after this call returns). */
     content: string;
     /** Every row removed this call, live or dormant: all whose normalized digest matched (not just the id
-     *  passed, per the K1/R7 duplicate lesson), and each sleep-merged row holding the value, whose other
+     *  passed, since duplicates share a digest), and each sleep-merged row holding the value, whose other
      *  texts move to a new row: listed in successorIds when it was live, dormantSuccessorIds when dormant. */
     removedIds: string[];
     /** Subset of removedIds that were kind='raw' (archived, not deleted). */