hippo-memory 1.61.0 → 1.63.0

package/dist/reject-flow.js

@@ -1,6 +1,5 @@
 /**
- * AT1 rejected-value tombstone — shared reject/unreject/list flow.
- * docs/plans/2026-08-15-at1-rejected-value-tombstone.md (T2, plan §4).
+ * Rejected-value tombstone: shared reject/unreject/list flow.
  *
  * The CLI (`hippo reject`/`rejections`/`unreject`) and the Context-based
  * `api.reject`/`api.unreject`/`api.listRejections` surfaces both need the
@@ -24,16 +23,7 @@ import { deleteEntryCore } from './store/delete-and-batch.js';
 import { heldTexts } from './same-text.js';
 import { mergedSuccessor } from './merged-row.js';
 import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
-/**
- * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
- * insert the tombstone, enumerate + remove every live tenant row whose
- * normalized digest matches (kind-aware), one aggregate `reject_value`
- * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
- * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
- * index.json itself is only refreshed by `rebuildIndex()`.
- */
-export function rejectValue(opts) {
+function assertRejectOpts(opts) {
     if (!opts.reason.trim()) {
         throw new Error('reject requires a non-empty --reason (the tombstone stores no content; reason is its only identity).');
     }
@@ -41,10 +31,8 @@ export function rejectValue(opts) {
         throw new Error('reject requires either a memory id or --value.');
     }
     if (opts.memoryId !== undefined && opts.value !== undefined) {
-        // P2 fix: the CLI's flag parser already refuses both forms together;
-        // the shared flow itself didn't enforce it, so a direct api caller
-        // passing both silently got the memoryId path with `value` ignored —
-        // surprising for a caller who thought they were rejecting `value`.
+        // Enforced here, not only in the CLI parser, so a direct api caller passing both
+        // is refused instead of silently getting the memoryId path with `value` ignored.
         throw new Error('reject accepts either a memory id or --value, not both.');
     }
     if (opts.value !== undefined && normalizeValueForRejection(opts.value).length === 0) {
@@ -53,28 +41,122 @@ export function rejectValue(opts) {
         // and pollute the listing.
         throw new Error('reject --value requires non-empty content.');
     }
-    const db = openStore(opts.hippoRoot);
-    try {
-        let content;
-        if (opts.memoryId !== undefined) {
-            // SAFETY: row's shape matches the two columns named in the SELECT above.
-            const row = db
-                .prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`)
-                .get(opts.memoryId);
-            if (!row || row.tenant_id !== opts.tenantId) {
-                throw new Error(`memory not found: ${opts.memoryId}`);
-            }
-            content = row.content;
+}
+function contentToReject(db, opts) {
+    if (opts.memoryId === undefined)
+        return opts.value;
+    // SAFETY: row's shape matches the two columns named in the SELECT above.
+    const row = db
+        .prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`)
+        .get(opts.memoryId);
+    if (!row || row.tenant_id !== opts.tenantId) {
+        throw new Error(`memory not found: ${opts.memoryId}`);
+    }
+    return row.content;
+}
+function removeLiveRows(db, opts, holdsValue, removal) {
+    const { removedIds, removedRawIds, successors } = removal;
+    const merged = [];
+    for (const row of selectAllEntries(db, opts.tenantId)) {
+        if (!holdsValue(row.content)) {
+            if (heldTexts(row).some(holdsValue))
+                merged.push(row);
+            continue;
+        }
+        if (row.kind === 'raw') {
+            // Append-only trigger respected — archiveRawMemory is the only
+            // legitimate removal path for kind='raw', and its inner SAVEPOINT
+            // composes safely inside this BEGIN/COMMIT.
+            archiveRawMemory(db, row.id, { reason: opts.reason, who: opts.actor });
+            removedRawIds.push(row.id);
         }
         else {
-            content = opts.value;
+            // suppressForgetAudit: the aggregate reject_value row below is the
+            // trail for these removals, not N individual forget rows.
+            deleteEntryCore(db, row.id, { actor: opts.actor, suppressForgetAudit: true });
+        }
+        removedIds.push(row.id);
+    }
+    for (const row of merged) {
+        const successor = mergedSuccessor(row, holdsValue, new Set(removedIds));
+        deleteEntryCore(db, row.id, { actor: opts.actor, suppressForgetAudit: true });
+        removedIds.push(row.id);
+        if (!successor)
+            continue;
+        const kept = stampOriginProject(opts.hippoRoot, successor);
+        writeEntryDbOnly(db, kept, { actor: opts.actor });
+        successors.push(kept);
+    }
+}
+// Dormant copies (src/dormant.ts), whole or inside a merged row, go too, in the same transaction: a
+// rejected value may not linger where `hippo dormant restore` could
+// bring it back. They have no markdown mirror, so the post-commit
+// mirror purge below is a no-op for them; they join removedIds for the
+// audit trail and the caller's report.
+function removeDormantCopies(db, tenantId, digest, holdsValue, removal) {
+    const { removedIds, dormantSuccessorIds } = removal;
+    removedIds.push(...purgeDormantByDigest(db, tenantId, digest));
+    for (const dormant of listDormantSnapshots(db, tenantId)) {
+        const successor = mergedSuccessor(dormant.entry, holdsValue, new Set(removedIds));
+        if (successor === undefined)
+            continue;
+        removedIds.push(dormant.entry.id);
+        if (!successor) {
+            deleteDormantRow(db, tenantId, dormant.entry.id);
+            continue;
+        }
+        replaceDormantEntry(db, tenantId, dormant.entry.id, successor);
+        dormantSuccessorIds.push(successor.id);
+    }
+}
+function auditRejectValue(db, opts, digest, removedIds) {
+    try {
+        appendAuditEvent(db, {
+            tenantId: opts.tenantId,
+            actor: opts.actor,
+            op: 'reject_value',
+            targetId: opts.memoryId,
+            metadata: { digest, removedIds, count: removedIds.length },
+        });
+    }
+    catch (error) {
+        // Inside the open transaction: the reject commits without its trail row rather than rolling back over bookkeeping.
+        reportAuditWriteFailure('reject_value', String(error), opts.memoryId);
+    }
+}
+// Post-commit, db handle still open (same pattern as api.archiveRaw):
+// best-effort mirror purge per removed id, reaper-backstop stamp for
+// raw ids.
+function purgeRemovedMirrors(db, hippoRoot, removal) {
+    for (const id of removal.removedIds) {
+        // purgeMirrorBestEffort retries once, then for non-raw ids (which the
+        // reaper never scans) reports the EXPLICIT leftover path(s). See its own doc comment (store.ts, near
+        // removeEntryMirrors) for the full rationale.
+        const mirrorOk = purgeMirrorBestEffort(hippoRoot, id, removal.removedRawIds.includes(id), 'hippo reject');
+        if (mirrorOk && removal.removedRawIds.includes(id)) {
+            db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
         }
+    }
+    for (const successor of removal.successors)
+        writeEntryMirrors(hippoRoot, successor);
+}
+/**
+ * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
+ * insert the tombstone, enumerate + remove every live tenant row whose
+ * normalized digest matches (kind-aware), one aggregate `reject_value`
+ * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
+ * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
+ */
+export function rejectValue(opts) {
+    assertRejectOpts(opts);
+    const db = openStore(opts.hippoRoot);
+    try {
+        const content = contentToReject(db, opts);
         const digest = rejectionDigest(content);
         const now = new Date().toISOString();
-        const removedIds = [];
-        const removedRawIds = [];
-        const successors = [];
-        const dormantSuccessorIds = [];
+        const removal = { removedIds: [], removedRawIds: [], successors: [], dormantSuccessorIds: [] };
         db.exec('BEGIN');
         try {
             insertRejectedValue(db, {
@@ -90,69 +172,9 @@ export function rejectValue(opts) {
             // on ~1-5k-row stores — acceptable, documented. A digest column on
             // memories is the escape if stores grow 100x; not needed now.
             const holdsValue = (text) => rejectionDigest(text) === digest;
-            const merged = [];
-            for (const row of selectAllEntries(db, opts.tenantId)) {
-                if (!holdsValue(row.content)) {
-                    if (heldTexts(row).some(holdsValue))
-                        merged.push(row);
-                    continue;
-                }
-                if (row.kind === 'raw') {
-                    // Append-only trigger respected — archiveRawMemory is the only
-                    // legitimate removal path for kind='raw', and its inner SAVEPOINT
-                    // composes safely inside this BEGIN/COMMIT.
-                    archiveRawMemory(db, row.id, { reason: opts.reason, who: opts.actor });
-                    removedRawIds.push(row.id);
-                }
-                else {
-                    // suppressForgetAudit: the aggregate reject_value row below is the
-                    // trail for these removals, not N individual forget rows (plan
-                    // §4, round-3 advisory 2 — mirrors api.ts:1873-1877).
-                    deleteEntryCore(db, row.id, { actor: opts.actor, suppressForgetAudit: true });
-                }
-                removedIds.push(row.id);
-            }
-            for (const row of merged) {
-                const successor = mergedSuccessor(row, holdsValue, new Set(removedIds));
-                deleteEntryCore(db, row.id, { actor: opts.actor, suppressForgetAudit: true });
-                removedIds.push(row.id);
-                if (!successor)
-                    continue;
-                const kept = stampOriginProject(opts.hippoRoot, successor);
-                writeEntryDbOnly(db, kept, { actor: opts.actor });
-                successors.push(kept);
-            }
-            // Dormant copies (src/dormant.ts), whole or inside a merged row, go too, in the same transaction: a
-            // rejected value may not linger where `hippo dormant restore` could
-            // bring it back. They have no markdown mirror, so the post-commit
-            // mirror purge below is a no-op for them; they join removedIds for the
-            // audit trail and the caller's report.
-            removedIds.push(...purgeDormantByDigest(db, opts.tenantId, digest));
-            for (const dormant of listDormantSnapshots(db, opts.tenantId)) {
-                const successor = mergedSuccessor(dormant.entry, holdsValue, new Set(removedIds));
-                if (successor === undefined)
-                    continue;
-                removedIds.push(dormant.entry.id);
-                if (!successor) {
-                    deleteDormantRow(db, opts.tenantId, dormant.entry.id);
-                    continue;
-                }
-                replaceDormantEntry(db, opts.tenantId, dormant.entry.id, successor);
-                dormantSuccessorIds.push(successor.id);
-            }
-            try {
-                appendAuditEvent(db, {
-                    tenantId: opts.tenantId,
-                    actor: opts.actor,
-                    op: 'reject_value',
-                    targetId: opts.memoryId,
-                    metadata: { digest, removedIds, count: removedIds.length },
-                });
-            }
-            catch (error) {
-                // Inside the open transaction: the reject commits without its trail row rather than rolling back over bookkeeping.
-                reportAuditWriteFailure('reject_value', String(error), opts.memoryId);
-            }
+            removeLiveRows(db, opts, holdsValue, removal);
+            removeDormantCopies(db, opts.tenantId, digest, holdsValue, removal);
+            auditRejectValue(db, opts, digest, removal.removedIds);
             db.exec('COMMIT');
         }
         catch (err) {
@@ -164,22 +186,8 @@ export function rejectValue(opts) {
             }
             throw err;
         }
-        // Post-commit, db handle still open (same pattern as api.archiveRaw):
-        // best-effort mirror purge per removed id, reaper-backstop stamp for
-        // raw ids.
-        for (const id of removedIds) {
-            // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
-            // which cleanupArchivedMirrors' reaper never scans — reports the
-            // EXPLICIT leftover path(s) instead of the false "will retry via
-            // reaper" claim. See its own doc comment (store.ts, near
-            // removeEntryMirrors) for the full rationale.
-            const mirrorOk = purgeMirrorBestEffort(opts.hippoRoot, id, removedRawIds.includes(id), 'hippo reject');
-            if (mirrorOk && removedRawIds.includes(id)) {
-                db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
-            }
-        }
-        for (const successor of successors)
-            writeEntryMirrors(opts.hippoRoot, successor);
+        purgeRemovedMirrors(db, opts.hippoRoot, removal);
+        const { removedIds, removedRawIds, successors, dormantSuccessorIds } = removal;
         return { digest, content, removedIds, removedRawIds, successorIds: successors.map((s) => s.id), dormantSuccessorIds };
     }
     finally {
@@ -192,11 +200,8 @@ export function rejectValue(opts) {
  * (plan §4): no per-write force flag.
  */
 export function unrejectValue(hippoRoot, tenantId, digestOrPrefix, actor) {
-    // P2 fix: an empty/blank prefix startsWith-matches EVERY digest (every
-    // string starts with ''), which would previously fall through to the
-    // ambiguous-candidates branch and list the whole tombstone set instead of
-    // failing loud on the actually-invalid input. Reject before the DB round
-    // trip.
+    // An empty/blank prefix startsWith-matches EVERY digest and would list the whole
+    // tombstone set as ambiguous, so reject it before the DB round trip.
     if (digestOrPrefix.trim().length === 0) {
         return { status: 'not_found' };
     }

package/dist/rejection.d.ts

@@ -1,6 +1,5 @@
 /**
- * AT1 rejected-value tombstone — core invariant.
- * docs/plans/2026-08-15-at1-rejected-value-tombstone.md
+ * Rejected-value tombstone: core invariant.
  *
  * Exact-normalized-value semantics: a human who rejects a fact can refuse
  * byte-stable re-ingestion of the same value across remember/capture/import/
@@ -64,7 +63,7 @@ export interface RejectedValueRow {
 export declare function findRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): RejectedValueRow | null;
 /**
  * Insert (or refresh) a tombstone row. Caller owns the transaction — used by
- * the T2 `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
+ * the `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
  */
 export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
     tenantId: string;
@@ -76,11 +75,11 @@ export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
     normalizedChars: number;
 }): void;
 /**
- * Delete a tombstone by tenant + exact digest — the T2 `unreject` verb, the
- * only v1 escape hatch (plan §4).
+ * Delete a tombstone by tenant + exact digest: the `unreject` verb, the
+ * only escape hatch.
  */
 export declare function deleteRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): boolean;
-/** List tombstones for a tenant, newest first — the T2 `rejections` verb. */
+/** List tombstones for a tenant, newest first: the `rejections` verb. */
 export declare function listRejectedValues(db: DatabaseSyncLike, tenantId: string): RejectedValueRow[];
 /**
  * The write-path guard's check helper, called from `upsertEntryRow`

package/dist/rejection.js

@@ -1,6 +1,5 @@
 /**
- * AT1 rejected-value tombstone — core invariant.
- * docs/plans/2026-08-15-at1-rejected-value-tombstone.md
+ * Rejected-value tombstone: core invariant.
  *
  * Exact-normalized-value semantics: a human who rejects a fact can refuse
  * byte-stable re-ingestion of the same value across remember/capture/import/
@@ -80,7 +79,7 @@ export function findRejectedValue(db, tenantId, digest) {
 }
 /**
  * Insert (or refresh) a tombstone row. Caller owns the transaction — used by
- * the T2 `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
+ * the `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
  */
 export function insertRejectedValue(db, opts) {
     db.prepare(`INSERT INTO rejected_values(tenant_id, digest, reason, rejected_by, rejected_at, source_memory_id, normalized_chars)
@@ -93,14 +92,14 @@ export function insertRejectedValue(db, opts) {
        normalized_chars = excluded.normalized_chars`).run(opts.tenantId, opts.digest, opts.reason, opts.rejectedBy, opts.rejectedAt, opts.sourceMemoryId ?? null, opts.normalizedChars);
 }
 /**
- * Delete a tombstone by tenant + exact digest — the T2 `unreject` verb, the
- * only v1 escape hatch (plan §4).
+ * Delete a tombstone by tenant + exact digest: the `unreject` verb, the
+ * only escape hatch.
  */
 export function deleteRejectedValue(db, tenantId, digest) {
     const result = db.prepare(`DELETE FROM rejected_values WHERE tenant_id = ? AND digest = ?`).run(tenantId, digest);
     return (result.changes ?? 0) > 0;
 }
-/** List tombstones for a tenant, newest first — the T2 `rejections` verb. */
+/** List tombstones for a tenant, newest first: the `rejections` verb. */
 export function listRejectedValues(db, tenantId) {
     // SAFETY: rows' shape matches the columns named in the SELECT above.
     const rows = db
@@ -134,15 +133,8 @@ export function checkRejectionGuard(db, tenantId, entryId, content) {
     // id the caller is already writing, and the tombstone lookup above is the
     // tenant-scoped decision. Matches deleteEntry's own by-id SELECT.
     //
-    // P2 fix: also read tenant_id. Content-digest-only comparison let a
-    // same-id upsert that ONLY changes tenantId slip through as an "unchanged
-    // re-persist" — content C sitting quietly (never rejected) in tenant A
-    // could be re-tagged into tenant B, and since C's digest already matched
-    // this row's stored digest, the guard exempted it even though B is the
-    // tenant that rejected C (that is WHY `tombstone` above is non-null: the
-    // lookup already ran under the INCOMING/destination tenantId). A tenant
-    // change on the SAME id is therefore always a content introduction into
-    // the destination tenant, exactly as if the row were new there.
+    // Also read tenant_id: a same-id upsert that only changes tenantId introduces the
+    // content into the destination tenant, exactly as if the row were new there.
     // SAFETY: storedRow's shape matches the two columns named in the SELECT above.
     const storedRow = db.prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`).get(entryId);
     const isNewRow = storedRow === undefined;

package/dist/rerankers/clef.d.ts

@@ -1,5 +1,5 @@
 import type { RerankerFn, RerankProvenance } from './types.js';
-import { type JsonValue } from '../http-util.js';
+import type { JsonValue } from '../json.js';
 /** The two pretrained CLEF decision models served by Cloudflare Workers AI. */
 export type ClefModel = 'clef-flash' | 'clef';
 /** True when `name` is one of the CLEF reranker names. */

package/dist/rerankers/jev.d.ts

@@ -16,7 +16,6 @@ export declare function createJevReranker(localFallback: RerankerFn): RerankerFn
 /** Orders `head` by `scores[i]`, keeping any upstream pre-rerank rank. Shared with CLEF. */
 export declare function rankByScores(head: readonly SearchResult[], scores: readonly number[]): RerankResult[];
 /** Track 4 reranker: hosted TypeSafe Jev, opt-in and paid (TYPESAFE_API_KEY), one batched call per recall.
- *  Any failure warns once and delegates to the local cross-encoder. Scores are not bit-stable run to run.
- *  Cost, env vars, evidence and limits: docs/evals/2026-09-19-jev-reranker.md. */
+ *  Any failure warns once and delegates to the local cross-encoder. Scores are not bit-stable run to run. */
 export declare const jevReranker: RerankerFn;
 //# sourceMappingURL=jev.d.ts.map

package/dist/rerankers/jev.js

@@ -5,10 +5,10 @@ import { log } from '../log.js';
 const ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const DEFAULT_TIMEOUT_MS = 5_000;
 const TRUNCATE_CHARS = 1200;
-// Pinned, not `jev-latest`: every number in docs/evals/2026-09-19-jev-reranker.md was
-// measured on this version, and the alias moves whenever the vendor ships a release.
+// Pinned, not `jev-latest`: the eval numbers were measured on this version,
+// and the alias moves whenever the vendor ships a release.
 const DEFAULT_MODEL = 'jev-1.13.0';
-// The pool size every number in docs/evals/2026-09-19-jev-reranker.md was measured at.
+// The pool size the eval numbers were measured at.
 export const JEV_DEFAULT_TOP_K = 40;
 function truncate(s, n) {
     return s.length <= n ? s : `${s.slice(0, n)}...`;
@@ -124,7 +124,6 @@ export function rankByScores(head, scores) {
     return scored;
 }
 /** Track 4 reranker: hosted TypeSafe Jev, opt-in and paid (TYPESAFE_API_KEY), one batched call per recall.
- *  Any failure warns once and delegates to the local cross-encoder. Scores are not bit-stable run to run.
- *  Cost, env vars, evidence and limits: docs/evals/2026-09-19-jev-reranker.md. */
+ *  Any failure warns once and delegates to the local cross-encoder. Scores are not bit-stable run to run. */
 export const jevReranker = createJevReranker(crossEncoderReranker);
 //# sourceMappingURL=jev.js.map

package/dist/rerankers/llm.d.ts

@@ -4,8 +4,7 @@ import type { RerankerFn } from './types.js';
  * OpenAI-compatible endpoint. Gated on HIPPO_LLM_RERANKER_URL to prevent
  * accidental cost.
  *
- * Skeleton only — see docs/plans/2026-05-10-f6-reranker-hardening.md Task 8.
- * Full characterisation deferred to a follow-on plan.
+ * Skeleton only; full characterisation is deferred.
  *
  * Timeout: defaults to 30s; overridable via HIPPO_LLM_RERANKER_TIMEOUT_MS.
  * On timeout or any fetch failure, the reranker warns once per process and

package/dist/rerankers/llm.js

@@ -7,8 +7,7 @@ const DEFAULT_TIMEOUT_MS = 30_000;
  * OpenAI-compatible endpoint. Gated on HIPPO_LLM_RERANKER_URL to prevent
  * accidental cost.
  *
- * Skeleton only — see docs/plans/2026-05-10-f6-reranker-hardening.md Task 8.
- * Full characterisation deferred to a follow-on plan.
+ * Skeleton only; full characterisation is deferred.
  *
  * Timeout: defaults to 30s; overridable via HIPPO_LLM_RERANKER_TIMEOUT_MS.
  * On timeout or any fetch failure, the reranker warns once per process and

package/dist/rerankers/types.d.ts

@@ -9,8 +9,7 @@ import type { SearchResult } from '../search/types.js';
  * Rerankers MUST be deterministic for a given (query, results) input
  * unless explicitly documented as stochastic (the LLM track, and the
  * hosted jev reranker, whose scores move slightly run to run).
- * Determinism is required for paired A/B and for the workload-validity
- * gate in docs/evals/2026-05-10-f6-reranker-prereg.md.
+ * Determinism is required for paired A/B and for the workload-validity gate.
  *
  * @returns Reordered (and optionally rescaled) results.
  */

package/dist/rrf.d.ts

@@ -4,13 +4,13 @@
  * Fuses N ranked candidate lists into a single ordering by summing
  * weighted 1/(k + rank) contributions per candidate. The constant K is
  * the canonical 60 from the original paper and the value already in use
- * across hippo's `hybridSearch` since v1.0. Do NOT tune K without an
+ * across hippo's `hybridSearch`. Do NOT tune K without an
  * explicit cross-corpus eval — it is calibrated against IR benchmarks
  * and works robustly across BM25/dense/cross-encoder rank-list shapes.
  *
  * Generic over the candidate id type so this helper can be shared by
  * `src/search.ts::hybridSearch` (T = number, idx into MemoryEntry[]) and
- * the LongMemEval F9 hybrid retrieve benchmark (T = string, session_id).
+ * the LongMemEval hybrid retrieve benchmark (T = string, session_id).
  *
  * Behaviour MUST stay byte-identical to the inline implementation that
  * lived in `src/search.ts:354-374` before extraction (commit ab6c5eb).

package/dist/rrf.js

@@ -4,13 +4,13 @@
  * Fuses N ranked candidate lists into a single ordering by summing
  * weighted 1/(k + rank) contributions per candidate. The constant K is
  * the canonical 60 from the original paper and the value already in use
- * across hippo's `hybridSearch` since v1.0. Do NOT tune K without an
+ * across hippo's `hybridSearch`. Do NOT tune K without an
  * explicit cross-corpus eval — it is calibrated against IR benchmarks
  * and works robustly across BM25/dense/cross-encoder rank-list shapes.
  *
  * Generic over the candidate id type so this helper can be shared by
  * `src/search.ts::hybridSearch` (T = number, idx into MemoryEntry[]) and
- * the LongMemEval F9 hybrid retrieve benchmark (T = string, session_id).
+ * the LongMemEval hybrid retrieve benchmark (T = string, session_id).
  *
  * Behaviour MUST stay byte-identical to the inline implementation that
  * lived in `src/search.ts:354-374` before extraction (commit ab6c5eb).

package/dist/search/bm25-search.d.ts

@@ -1,5 +1,5 @@
 import type { MemoryEntry } from '../memory.js';
-import type { ResultCost, SearchResult } from './types.js';
+import { type ResultCost, type SearchResult } from './types.js';
 export interface SearchOptions {
     budget?: number;
     now?: Date;

package/dist/search/bm25-search.js

@@ -9,6 +9,7 @@ import { currentEntries } from './as-of.js';
 import { applyRankBoosts, strengthRecencyMultipliers, NO_SUMMARY_SCORING } from './boosts.js';
 import { temporalContext } from './temporal.js';
 import { dedupeExtracted, fitBudget, withDagChildren } from './finalize.js';
+import { DEFAULT_RECALL_BUDGET } from './types.js';
 /** Synchronous BM25 search: relevance * strength * recency and the rank boosts, without embeddings or the outcome nudge. */
 export function search(query, entries, options = {}) {
     const now = options.now ?? evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
@@ -38,6 +39,6 @@ export function search(query, entries, options = {}) {
         scored.push({ entry: pool[i], score, bm25, cosine: 0, tokens: estimateTokens(pool[i].content) });
     }
     scored.sort(compareScoredResults);
-    return fitBudget(withDagChildren(dedupeExtracted(scored), pool), options.budget ?? 4000, options.minResults ?? 1, options.cost);
+    return fitBudget(withDagChildren(dedupeExtracted(scored), pool), options.budget ?? DEFAULT_RECALL_BUDGET, options.minResults ?? 1, options.cost);
 }
 //# sourceMappingURL=bm25-search.js.map

package/dist/search/boosts.js

@@ -5,6 +5,7 @@ import { pathBoostMultiplier } from '../path-context.js';
 import { scopeMatch } from '../scope.js';
 import { temporalBoost } from './temporal.js';
 export const CHURN_STALE_RANK_MULTIPLIER = 0.5; // SHORTCUT: untuned; measure on real recall before any default.
+const DECISION_TAG_BOOST = 1.2;
 const DEFAULT_SUMMARY_DEBOOST = 0.85;
 const DEFAULT_FRESHNESS_BOOST = 1.05;
 const FRESHNESS_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
@@ -69,7 +70,7 @@ export function strengthRecencyMultipliers(entry, now) {
 }
 /** Applies every rank multiplier one at a time, in a fixed order, so float rounding matches across paths. */
 export function applyRankBoosts(score, entry, ctx) {
-    const decisionBoost = entry.tags.includes('decision') ? 1.2 : 1.0;
+    const decisionBoost = entry.tags.includes('decision') ? DECISION_TAG_BOOST : 1.0;
     const churnStaleMultiplier = churnStaleFactor(entry);
     const pathBoost = pathBoostMultiplier(entry.tags, ctx.pathTags);
     const outcomeBoost = ctx.outcome ? outcomeMultiplier(entry) : 1.0;

package/dist/search/hybrid.d.ts

@@ -3,7 +3,7 @@ import type { RerankerFn, RerankerOptions } from '../rerankers/types.js';
 import { type BM25Corpus } from './bm25.js';
 import { type HybridVectorCandidates } from './vector.js';
 import { type GraphStreamOptions } from './fusion.js';
-import type { ResultCost, SearchResult } from './types.js';
+import { type ResultCost, type SearchResult } from './types.js';
 export interface HybridSearchOptions {
     budget?: number;
     now?: Date;

package/dist/search/hybrid.js

@@ -12,6 +12,7 @@ import { fuseRanks } from './fusion.js';
 import { scoreHybridPool } from './hybrid-score.js';
 import { applyMmrWindow, applyReranker } from './rerank.js';
 import { dedupeExtracted, fitBudget, withDagChildren } from './finalize.js';
+import { DEFAULT_RECALL_BUDGET } from './types.js';
 /** BM25 blended with cosine similarity when stored vectors and a provider are available, BM25 * strength * recency otherwise. */
 export async function hybridSearch(query, entries, options = {}) {
     const now = options.now ?? evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
@@ -42,7 +43,7 @@ export async function hybridSearch(query, entries, options = {}) {
     });
     scored.sort(compareScoredResults);
     const ordered = await orderHybrid(query, withDagChildren(dedupeExtracted(scored), arm.entries), arm, options);
-    return fitBudget(ordered, options.budget ?? 4000, options.minResults ?? 1, options.cost);
+    return fitBudget(ordered, options.budget ?? DEFAULT_RECALL_BUDGET, options.minResults ?? 1, options.cost);
 }
 function hybridBoostContext(query, pool, now, options) {
     return {

package/dist/search/physics-search.d.ts

@@ -1,7 +1,7 @@
 import { type MemoryEntry } from '../memory.js';
 import { type PhysicsConfig } from '../physics-config.js';
 import { type HybridVectorCandidates } from './vector.js';
-import type { ResultCost, SearchResult } from './types.js';
+import { type ResultCost, type SearchResult } from './types.js';
 export interface PhysicsSearchOptions {
     budget?: number;
     now?: Date;

package/dist/search/physics-search.js

@@ -15,6 +15,7 @@ import { fitBudget } from './finalize.js';
 import { hybridSearch } from './hybrid.js';
 import { currentEntries } from './as-of.js';
 import { vectorCandidatesOutside } from './vector.js';
+import { DEFAULT_RECALL_BUDGET } from './types.js';
 /** Scores memories by gravity, momentum and cluster amplification; rows without physics state rank through hybridSearch. */
 export async function physicsSearch(query, entries, options = {}) {
     const now = options.now ?? evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
@@ -41,7 +42,7 @@ export async function physicsSearch(query, entries, options = {}) {
         : [];
     const merged = mergeScorePools(physicsResults, classicResults);
     merged.sort(compareScoredResults);
-    return fitBudget(merged, options.budget ?? 4000, options.minResults ?? 1, options.cost);
+    return fitBudget(merged, options.budget ?? DEFAULT_RECALL_BUDGET, options.minResults ?? 1, options.cost);
 }
 /** The caller's vector, else the provider's; null sends the caller to hybridSearch. */
 async function physicsQueryVector(query, root, given) {

package/dist/search/types.d.ts

@@ -1,4 +1,6 @@
 import type { MemoryEntry } from '../memory.js';
+export declare const DEFAULT_RECALL_BUDGET = 4000;
+export declare const DEFAULT_LOCAL_BUMP = 1.2;
 /** One score mutation applied after candidate generation; allocated only under `recall --why` or `RecallOpts.explain`. */
 export interface RerankStep {
     /** One of: interference, value, utility, reranker, goal-boost, retrieval-count-downweight. */

package/dist/search/types.js

@@ -1,2 +1,4 @@
-export {};
+export const DEFAULT_RECALL_BUDGET = 4000;
+// Local memories outrank global ones by this factor; getContext applies it as a 1/x global discount.
+export const DEFAULT_LOCAL_BUMP = 1.2;
 //# sourceMappingURL=types.js.map

package/dist/secret-detect.d.ts

@@ -1,6 +1,5 @@
 /**
- * Secret detection for memory content (v39 memory scope isolation, S4;
- * docs/plans/2026-07-01-memory-scope-isolation.md).
+ * Secret detection for memory content (memory scope isolation).
  *
  * Conservative, provider-bounded patterns only - a bare `sk-` in prose must
  * NOT flag. Detection gates two surfaces:
@@ -11,7 +10,7 @@
  *    project origin. Explicit recall is unaffected - recalling a secret is
  *    a deliberate act.
  *
- * This is deliberately a thin slice of the A4 lifecycle-compliance item
+ * This is deliberately a thin slice of lifecycle compliance
  * (no PII detection). Write-time scrubbing covers only text no person
  * typed into hippo; see `vetSecrets`.
  *
@@ -37,8 +36,8 @@ export declare function detectSecret(entry: {
  * Replace secret-shaped substrings in free text with a redaction marker.
  * Reuses the same `SECRET_PATTERNS` / co-occurrence guard as `detectSecret`
  * (which only flags whole-entry content) so callers that must persist raw
- * text that never passes through the normal capture content gate — e.g. the
- * CS1 pre-compact snapshot fields — can scrub it in place instead.
+ * text that never passes through the normal capture content gate (e.g. the
+ * pre-compact snapshot fields) can scrub it in place instead.
  */
 export declare function redactSecrets(text: string): string;
 /** Memories never hold a raw email address (AGENTS.md); phone numbers are left alone, as their patterns misfire on ids. */