hippo-memory 1.61.0 → 1.63.0

package/dist/audit-prune.d.ts

@@ -1,5 +1,5 @@
 /**
- * Audit log retention pruning (v1.12.9).
+ * Audit log retention pruning.
  *
  * The `audit_log` table grows unbounded by default — every recall, write,
  * outcome, sleep, supersede, promote, forget, archive_raw, auth_revoke,
@@ -7,10 +7,8 @@
  * accumulate to millions of rows and slow down both audit queries and
  * incremental SQLite VACUUMs.
  *
- * Closes TODOS A5 v2 M6: "Audit log unbounded growth. Add a daily `audit
- * prune` cron + `hippo audit prune --older-than 90d` CLI in v2. Mind
- * regulatory retention floors (HIPAA, SOX, GDPR) — the prune should be
- * opt-in per tenant and emit its own audit trail event."
+ * Regulatory retention floors (HIPAA, SOX, GDPR) are why the prune is opt-in
+ * per tenant and emits its own audit trail event.
  *
  * Design notes:
  *   - Per-tenant by default (matches existing audit CLI conventions).
@@ -29,7 +27,7 @@ import type { DatabaseSyncLike } from './db.js';
 export interface PruneAuditOpts {
     /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
     olderThanDays: number;
-    /** Tenant scope. Required — prune is always tenant-scoped per the A5 v2 design. */
+    /** Tenant scope. Required: prune is always tenant-scoped. */
     tenantId: string;
     /** When true, count matching rows but do NOT delete. Default false. */
     dryRun?: boolean;

package/dist/audit-prune.js

@@ -1,5 +1,5 @@
 /**
- * Audit log retention pruning (v1.12.9).
+ * Audit log retention pruning.
  *
  * The `audit_log` table grows unbounded by default — every recall, write,
  * outcome, sleep, supersede, promote, forget, archive_raw, auth_revoke,
@@ -7,10 +7,8 @@
  * accumulate to millions of rows and slow down both audit queries and
  * incremental SQLite VACUUMs.
  *
- * Closes TODOS A5 v2 M6: "Audit log unbounded growth. Add a daily `audit
- * prune` cron + `hippo audit prune --older-than 90d` CLI in v2. Mind
- * regulatory retention floors (HIPAA, SOX, GDPR) — the prune should be
- * opt-in per tenant and emit its own audit trail event."
+ * Regulatory retention floors (HIPAA, SOX, GDPR) are why the prune is opt-in
+ * per tenant and emits its own audit trail event.
  *
  * Design notes:
  *   - Per-tenant by default (matches existing audit CLI conventions).

package/dist/audit.js

@@ -18,23 +18,16 @@ const VAGUE_ONLY = /^[\w\s,.'"-]+$/;
 // CJK words average ~2 characters, so approximate substantive units as one per
 // 2 CJK LETTERS.
 //
-// Two properties this must hold, both learned from codex review findings:
-//  1. Letters only, enforced by construction. Two separate wrong guesses were
-//     caught here: a Katakana BLOCK range counts the middle dot and prolonged
-//     sound mark, and `\p{Script=Han}` alone still counts Han-script
-//     NON-letters (Kangxi radicals, the old Chinese hook mark) because Script
-//     properties are not restricted to letters. The `(?=\p{L})` lookahead
-//     makes "letters only" true by definition rather than by assertion, and
-//     the category sweep in tests/df3-cjk-quality-floor.test.ts pins it so the
-//     next wrong guess fails locally instead of in review.
+// Two properties this must hold:
+//  1. Letters only, enforced by construction: a Katakana BLOCK range counts the
+//     middle dot and prolonged sound mark, and `\p{Script=Han}` alone counts
+//     Han NON-letters (Kangxi radicals), so the `(?=\p{L})` lookahead makes
+//     "letters only" true by definition; tests/df3-cjk-quality-floor.test.ts sweeps it.
 //
 // SCOPE, stated precisely because the constant name says "CJK": this covers
 // Han, Hiragana and Katakana only. Hangul is absent (Korean largely survives
 // the whitespace split already) and other spaceless scripts - Thai, Khmer,
-// Burmese, Lao - still hit the original one-word failure. Their behavior is
-// byte-identical to before this change, so nothing regressed; widening the
-// script set is a separate, deliberately-scoped follow-up rather than another
-// mid-episode guess at this predicate.
+// Burmese, Lao - still hit the original one-word failure.
 //  2. ADD to the latin count, never strip before it. Stripping CJK first can
 //     REDUCE the count for short mixed tokens (`UI<han> DB<han> QA<han>` leaves
 //     three 2-char latin fragments that fail the `> 2` filter), which would
@@ -84,25 +77,10 @@ function hasNoSpecificity(text) {
     const words = text.toLowerCase().split(/\s+/);
     const hasNumber = /\d/.test(text);
     const hasProperNoun = /[A-Z][a-z]{2,}/.test(text);
-    // An ACRONYM is specificity too, and this test could not see one: the
-    // proper-noun pattern needs lowercase after the capital, so "PR", "CI",
-    // "DB", "API", "S3" - the densest domain tokens in a technical memory -
-    // all read as vague. Surfaced by DF2: clause-bounding correctly shortened
-    // "The rule is every PR needs two approvals, no exceptions." to "every PR
-    // needs two approvals", which then fell under the 40-char vagueness gate
-    // and was silently DROPPED - a rule that stored before this branch.
-    // ...but an acronym only signals specificity when it stands out AGAINST
-    // ordinary prose. Without the lowercase requirement, any shouted phrase
-    // qualifies: "FIXED SIGNALS" passed the gate while the identical
-    // "fixed signals" was correctly rejected, so capitalization alone bought a
-    // bypass - into auditMemory and includeRecent as well, where junk would
-    // then occupy recent-context slots. Codex P2, r8.
-    // CHAT acronyms are not domain signal. Admitting any all-caps token let
-    // "LGTM ship it", "TODO fix this thing", "FYI all done here" through a gate
-    // that correctly rejected them before - and this gate is shared, so the
-    // effect is retroactive: junk rows already in a user's store were filtered
-    // out of recent-context slots and would have started occupying them, and
-    // `hippo audit` would have stopped flagging them. Found at the ship gate.
+    // An ACRONYM is specificity too: the proper-noun pattern needs lowercase after the capital, so
+    // "PR", "CI", "DB", "API", "S3" (the densest domain tokens in a technical memory) all read as vague.
+    // It counts only against ordinary prose (the lowercase test), else a shouted phrase bypasses the gate,
+    // and CHAT acronyms never count: the gate is shared, so "LGTM ship it" would reach recent-context slots.
     const CHAT_ACRONYMS = /^(?:TODO|FYI|LGTM|IIRC|IMO|IMHO|FWIW|TBD|BTW|ASAP|AFAIK|WIP|NB|PS)$/;
     const domainAcronyms = (text.match(/\b[A-Z]{2,6}\b/g) ?? []).filter(a => !CHAT_ACRONYMS.test(a));
     const hasAcronym = domainAcronyms.length > 0 && /[a-z]/.test(text);
@@ -173,7 +151,7 @@ export function isContentWorthStoring(content) {
     return true;
 }
 // ---------------------------------------------------------------------------
-// A5 audit log primitives (append-only mutation trail)
+// Audit log primitives (append-only mutation trail)
 // ---------------------------------------------------------------------------
 // The one list of audit ops: the AuditOp type, `hippo audit list --op` and GET /v1/audit?op= all read it.
 export const AUDIT_OPS = [

package/dist/auth.d.ts

@@ -11,7 +11,7 @@ export declare function apiKeyVerifyStats(): ApiKeyVerifyStats;
 export interface CreateApiKeyOpts {
     tenantId: string;
     label?: string;
-    /** v1.12.0 A5 v2 sub-1: 'admin' | 'member'. Defaults to 'admin' (backward-compat for callers that don't specify). */
+    /** 'admin' | 'member'. Defaults to 'admin' (backward-compat for callers that don't specify). */
     role?: 'admin' | 'member';
 }
 export interface CreateApiKeyResult {
@@ -23,9 +23,9 @@ export interface ValidateResult {
     valid: boolean;
     tenantId?: string;
     keyId?: string;
-    /** v1.12.0 A5 v2 sub-1: 'admin' | 'member'. Present only when valid=true. */
+    /** 'admin' | 'member'. Present only when valid=true. */
     role?: 'admin' | 'member';
-    /** EI2: scope grants for this key. Present only when valid=true. */
+    /** Scope grants for this key. Present only when valid=true. */
     scopes?: string[];
 }
 /** The identity a verified API key carries. */
@@ -52,11 +52,11 @@ export declare class VerifiedKeyCache {
 /** Verify a bearer API key for `hippoRoot`; a cache hit skips both scrypt and the DB open. Null when invalid. */
 export declare function verifyApiKeyCached(hippoRoot: string, plaintext: string): VerifiedApiKey | null;
 export declare function revokeApiKey(db: DatabaseSyncLike, keyId: string): void;
-/** EI2: grant `keyId` read access to one restricted `scope`. Idempotent. */
+/** Grant `keyId` read access to one restricted `scope`. Idempotent. */
 export declare function grantScope(db: DatabaseSyncLike, keyId: string, scope: string): void;
-/** EI2: revoke `keyId`'s grant on `scope`. Not an error when no such grant exists. */
+/** Revoke `keyId`'s grant on `scope`. Not an error when no such grant exists. */
 export declare function ungrantScope(db: DatabaseSyncLike, keyId: string, scope: string): void;
-/** EI2: every restricted scope `keyId` may read. */
+/** Every restricted scope `keyId` may read. */
 export declare function listScopeGrants(db: DatabaseSyncLike, keyId: string): string[];
 export interface ApiKeyListItem {
     keyId: string;
@@ -65,12 +65,11 @@ export interface ApiKeyListItem {
     createdAt: string;
     revokedAt: string | null;
     /**
-     * v1.12.3: authorization role bound to the key. SELECT extended to read
-     * the `role` column (added in schema migration v26 by v1.12.0 sub-1).
+     * Authorization role bound to the key, from the `role` column (schema migration v26).
      * Fail-safe-to-member cast: any non-'admin' value reads as 'member'.
      */
     role: 'admin' | 'member';
-    /** EI2: restricted scopes this key may read. */
+    /** Restricted scopes this key may read. */
     scopes: string[];
 }
 export interface ListApiKeysOpts {

package/dist/auth.js

@@ -40,10 +40,8 @@ export function createApiKey(db, opts) {
     const secret = randBase32(SECRET_LEN);
     const plaintext = `${keyId}.${secret}`;
     const hash = hashKey(plaintext);
-    // v1.12.0: 6-column INSERT including role. Boot-order guarantee:
-    // openHippoDb runs runMigrations synchronously before returning the db
-    // handle, so migration v26 (adds role column) is in place before this
-    // INSERT runs.
+    // openHippoDb runs runMigrations synchronously before returning the db handle,
+    // so migration v26 (adds role column) is in place before this INSERT runs.
     db.prepare(`INSERT INTO api_keys (key_id, key_hash, tenant_id, label, created_at, role) VALUES (?, ?, ?, ?, ?, ?)`).run(keyId, hash, opts.tenantId, opts.label ?? null, new Date().toISOString(), opts.role ?? 'admin');
     return { keyId, plaintext };
 }
@@ -146,18 +144,18 @@ export function revokeApiKey(db, keyId) {
         .run(new Date().toISOString(), keyId);
     verifiedKeys.delete(keyId);
 }
-/** EI2: grant `keyId` read access to one restricted `scope`. Idempotent. */
+/** Grant `keyId` read access to one restricted `scope`. Idempotent. */
 export function grantScope(db, keyId, scope) {
     db.prepare(`INSERT INTO api_key_scope_grants (key_id, scope, granted_at) VALUES (?, ?, ?)
      ON CONFLICT(key_id, scope) DO NOTHING`).run(keyId, scope, new Date().toISOString());
     verifiedKeys.delete(keyId);
 }
-/** EI2: revoke `keyId`'s grant on `scope`. Not an error when no such grant exists. */
+/** Revoke `keyId`'s grant on `scope`. Not an error when no such grant exists. */
 export function ungrantScope(db, keyId, scope) {
     db.prepare(`DELETE FROM api_key_scope_grants WHERE key_id = ? AND scope = ?`).run(keyId, scope);
     verifiedKeys.delete(keyId);
 }
-/** EI2: every restricted scope `keyId` may read. */
+/** Every restricted scope `keyId` may read. */
 export function listScopeGrants(db, keyId) {
     // SAFETY: rows' shape matches the single `scope` column named in the SELECT above.
     const rows = db

package/dist/autolearn.d.ts

@@ -30,7 +30,7 @@ export declare function partitionLessons(lessons: string[]): {
  * Check if a substantially similar memory already exists.
  * Returns true if overlap > threshold (default 0.7).
  *
- * L9: `tenantId` is opt-in. Only takes effect when the first argument is a
+ * `tenantId` is opt-in. Only takes effect when the first argument is a
  * root string (string-overload path). When the first argument is a
  * pre-loaded MemoryEntry[], the caller has already scoped — tenantId is
  * ignored on that path.

package/dist/autolearn.js

@@ -100,7 +100,7 @@ export function partitionLessons(lessons) {
  * Check if a substantially similar memory already exists.
  * Returns true if overlap > threshold (default 0.7).
  *
- * L9: `tenantId` is opt-in. Only takes effect when the first argument is a
+ * `tenantId` is opt-in. Only takes effect when the first argument is a
  * root string (string-overload path). When the first argument is a
  * pre-loaded MemoryEntry[], the caller has already scoped — tenantId is
  * ignored on that path.

package/dist/availability.js

@@ -1,5 +1,5 @@
 // ---------------------------------------------------------------------------
-// J2 — Availability-bias detector (Track J: biases-over-memory-state)
+// Availability-bias detector (biases over memory state)
 // ---------------------------------------------------------------------------
 //
 // Flags when a recall's returned top-K is dominated by recent entries while
@@ -10,10 +10,8 @@
 // creation timestamp, so we can compare the age distribution of what was
 // RETURNED against the age distribution of the pool it was drawn from.
 //
-// Soft warning ONLY (ROADMAP-RESEARCH.md Track J discipline note): this never
-// filters, reorders, or suppresses a result. It surfaces a hint the calling
-// agent may choose to act on, exactly like J1 anchoringHint / J3
-// planningFallacyHint / C5 suppressionSummary.
+// Soft warning ONLY: this never filters, reorders, or suppresses a result. It surfaces
+// a hint the calling agent may act on, like anchoringHint / planningFallacyHint / suppressionSummary.
 //
 // PURE: no I/O, no env reads. The env gate (HIPPO_AVAILABILITY=off) and the
 // audit emission live in the callers (api.recall, cmdRecall, MCP), mirroring

package/dist/capture/command.d.ts

@@ -1,3 +1,4 @@
+import { type ProjectRef } from '../project-identity.js';
 import { type SessionTurn } from './transcript.js';
 export interface CaptureOptions {
     source: 'stdin' | 'file' | 'last-session';
@@ -21,13 +22,13 @@ export interface CaptureOptions {
     dryRun: boolean;
     global: boolean;
     /**
-     * L9: tenant scope for the dedup read in `cmdCaptureCore`. When provided
+     * Tenant scope for the dedup read in `cmdCaptureCore`. When provided
      * AND `global` is false, the dedup check only considers this tenant's
-     * existing memories. Undefined preserves pre-1.12.1 host-wide dedup
-     * behaviour. Ignored when `global: true` (global captures are host-wide).
+     * existing memories. Undefined means host-wide dedup. Ignored when `global: true` (global captures are host-wide).
      */
     tenantId?: string;
-    originProject?: string;
+    /** The session's project: rows are stamped with its id, and dedup reads its rows under either name. */
+    originProject?: ProjectRef;
 }
 export declare function cmdCapture(hippoRoot: string, options: CaptureOptions): void;
 //# sourceMappingURL=command.d.ts.map

package/dist/capture/command.js

@@ -14,7 +14,7 @@ import { maskEmails, redactSecretsStrict } from '../secret-detect.js';
 import { RejectedValueError, checkRejectionGuard } from '../rejection.js';
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { loadConfig } from '../config.js';
-import { classifyOriginProject } from '../project-identity.js';
+import { classifyOriginProject, projectId } from '../project-identity.js';
 import { isStringValue } from '../capture-contract.js';
 import { errorMessage, log } from '../log.js';
 import { extractFromText } from './extract.js';
@@ -116,7 +116,7 @@ function cmdCaptureCore(hippoRoot, options) {
         console.log('No actionable items found in the input.');
         return;
     }
-    // Dedup only against rows this capture's reader sees: another tenant's rows (L9), or another
+    // Dedup only against rows this capture's reader sees: another tenant's rows, or another
     // project's, are hidden from it, so they must not stop its own copy.
     const stored = loadAllEntries(targetRoot, useGlobal ? undefined : options.tenantId);
     const origin = options.originProject;
@@ -175,13 +175,8 @@ function readCaptureText(options) {
 function captureExtractedItems(targetRoot, options, extracted, keys) {
     const tally = { captured: 0, skipped: 0, rejected: 0 };
     const baseHalfLifeDays = loadConfig(targetRoot).defaultHalfLifeDays;
-    // AT1 P2 fix (dry-run parity, docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
-    // dry-run used to skip the guarded write branch ENTIRELY, so a tombstoned
-    // extraction printed as `[capture]` and counted toward `captured` — the
-    // preview lied about what a real run would do. Mirrors importers.ts's
-    // importEntries dry-run probe (commit 6146e82): open a read-only handle
-    // once, run the same checkRejectionGuard the real write path uses via
-    // writeEntry, never write anything.
+    // Dry run probes the same checkRejectionGuard the real write uses, on a read-only handle,
+    // so a tombstoned item previews as rejected rather than captured.
     const dryRunDb = options.dryRun ? openHippoDb(targetRoot) : null;
     const writeDb = options.dryRun ? null : openStore(targetRoot);
     try {
@@ -207,16 +202,8 @@ function captureExtractedItems(targetRoot, options, extracted, keys) {
 }
 function captureEntry(item, options, baseHalfLifeDays) {
     const useGlobal = options.global;
-    // A3: kind defaults to 'distilled'. capture.ts extracts curated items from
-    // session output (not raw transcript chunks), so distilled is correct. If a
-    // future variant captures full raw session text, it MUST set kind: 'raw'
-    // and route deletions through archiveRawMemory(). See MEMORY_ENVELOPE.md.
-    // L9: the dedup read above is scoped by options.tenantId — the WRITE
-    // must match, or scoped-dedup-passes-then-default-tenant-write breaks
-    // the per-tenant contract. Mirror the dedup-read guard: when
-    // global: true, the global store is host-wide and tenant is irrelevant
-    // (createMemory's default 'default' applies). When global: false,
-    // options.tenantId scopes the write to the same tenant as the dedup.
+    // kind stays 'distilled': these are curated items, not raw transcript (see MEMORY_ENVELOPE.md).
+    // The write tenant must match the dedup read's, or scoped dedup passes and the row lands in 'default'.
     const created = createMemory(item.content, {
         layer: Layer.Episodic,
         tags: item.tags,
@@ -225,7 +212,7 @@ function captureEntry(item, options, baseHalfLifeDays) {
         tenantId: useGlobal ? undefined : options.tenantId,
         baseHalfLifeDays,
     });
-    return options.originProject === undefined ? created : { ...created, origin_project: options.originProject };
+    return options.originProject === undefined ? created : { ...created, origin_project: projectId(options.originProject) };
 }
 /** Previews or writes one non-duplicate item and names the tally it counts toward. */
 function captureOne(ctx, item, entry) {
@@ -246,8 +233,7 @@ function captureOne(ctx, item, entry) {
         console.log(`  [capture] (${item.category}) ${item.content}`);
     }
     else if (writeDb !== null) {
-        // AT1 (plan §3 containment): one rejected item must not abort the
-        // rest of this capture's items.
+        // One rejected item must not abort the rest of this capture's items.
         const stamped = stampOriginProject(targetRoot, entry);
         const outcome = gatedWrite(writeDb, targetRoot, stamped);
         if (outcome === 'skipped:rejected')

package/dist/capture/compact.d.ts

@@ -7,7 +7,7 @@ export declare const PRE_COMPACT_NEXT_STEP_CAP = 500;
  * newest with assistant responses after them, so a head-first cap keeps
  * stale context and drops exactly the newest working state this feature
  * exists to preserve. Keep the LAST maxChars instead, aligned forward to a
- * nearby line start, with a trim marker (codex round 3).
+ * nearby line start, with a trim marker.
  */
 export declare function truncateKeepNewest(text: string, maxChars: number): string;
 /**
@@ -37,7 +37,7 @@ export declare function cmdPreCompact(hippoRoot: string, options: PreCompactOpti
 export interface PostCompactOptions {
     stdinText?: string;
     logFile?: string;
-    afterSave?: (transcriptPath: string, originProject: string, log: (message: string) => void) => void;
+    afterSave?: (transcriptPath: string, cwd: string | null, log: (message: string) => void) => void;
 }
 /** PostCompact entry point: saves the summary and its items, replays earlier leftovers, returns the one line to show. Never throws, so the hook exits 0. */
 export declare function cmdPostCompact(hippoRoot: string, options: PostCompactOptions): string | null;

package/dist/capture/compact.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { isInitialized } from '../store/open.js';
 import { saveActiveTaskSnapshot, loadActiveTaskSnapshot } from '../store/sessions.js';
-import { PRE_COMPACT_INSTRUCTION, compactionOrigin, parsePostCompactPayload, postCompactLine, recordCompactionStart, recordSnapshotSaved, saveCompaction, replayCompactionsAt, COMPACTION_DB_WAIT_MS, } from '../compaction-record.js';
+import { PRE_COMPACT_INSTRUCTION, parsePostCompactPayload, postCompactLine, recordCompactionStart, recordSnapshotSaved, saveCompaction, replayCompactionsAt, COMPACTION_DB_WAIT_MS, } from '../compaction-record.js';
 import { resolveTenantId } from '../tenant.js';
 import { defaultPreCompactLogPath } from '../hooks/shared.js';
 import { maskEmails, redactSecretsStrict } from '../secret-detect.js';
@@ -21,7 +21,7 @@ export const PRE_COMPACT_NEXT_STEP_CAP = 500;
  * newest with assistant responses after them, so a head-first cap keeps
  * stale context and drops exactly the newest working state this feature
  * exists to preserve. Keep the LAST maxChars instead, aligned forward to a
- * nearby line start, with a trim marker (codex round 3).
+ * nearby line start, with a trim marker.
  */
 export function truncateKeepNewest(text, maxChars) {
     if (text.length <= maxChars)
@@ -154,7 +154,7 @@ export function transcriptWorkingState(transcriptPath, log) {
     let rawTask = '';
     let rawNextStep = '';
     try {
-        // Compaction fires when a big tool_result lands (CX7), so the last human and assistant turns can sit
+        // Compaction fires when a big tool_result lands, so the last human and assistant turns can sit
         // megabytes back: grow the window a bounded number of times until both turns are in it.
         const size = fs.statSync(transcriptPath).size;
         for (const cap of [PRE_COMPACT_TAIL_BYTES, PRE_COMPACT_TAIL_BYTES * 4, PRE_COMPACT_TAIL_BYTES * 16]) {
@@ -176,8 +176,8 @@ export function transcriptWorkingState(transcriptPath, log) {
         log('skip: empty summary');
         return null;
     }
-    // X9: these fields skip the capture content gate and reach a prompt, so the strict scrub runs. The caps protect the
-    // re-injection token budget and never split a surrogate pair (X2); `hippo snapshot save` stays uncapped.
+    // These fields skip the capture content gate and reach a prompt, so the strict scrub runs. The caps protect the
+    // re-injection token budget and never split a surrogate pair; `hippo snapshot save` stays uncapped.
     const task = maskEmails(redactSecretsStrict(rawTask));
     const summary = maskEmails(redactSecretsStrict(rawSummary));
     const nextStep = maskEmails(redactSecretsStrict(rawNextStep));
@@ -189,7 +189,7 @@ export function transcriptWorkingState(transcriptPath, log) {
 }
 /** Runs the PreCompact producer: records the compaction, asks the summariser for memories, saves a working-state snapshot. Never extracts memories itself; SessionEnd capture owns that. */
 function runPreCompact(hippoRoot, stdinText, stdinTimedOut, logFile) {
-    // X3: the PreCompact hook fires in every Claude Code project, including
+    // The PreCompact hook fires in every Claude Code project, including
     // ones that never ran `hippo init`, so gate before any store-opening call
     // (saveActiveTaskSnapshot etc. call initStore, which would create one).
     if (!isInitialized(hippoRoot)) {
@@ -219,12 +219,8 @@ function runPreCompact(hippoRoot, stdinText, stdinTimedOut, logFile) {
 }
 /** The transcript to snapshot, or null after logging why there is none. */
 function resolvePreCompactTranscript(payloadTranscriptPath, stdinText, logFile) {
-    // A payload transcript_path is EXCLUSIVE: never fall back to
-    // newest-transcript auto-discovery when it's missing/unreadable. That
-    // fallback would snapshot a DIFFERENT session's transcript under THIS
-    // payload's session_id — cross-session contamination with wrong linkage
-    // (verify-stage E2E finding, 2026-08-03). Auto-discovery only applies
-    // on a true manual invocation (no payload at all).
+    // A payload transcript_path is EXCLUSIVE: auto-discovery would snapshot a DIFFERENT session's
+    // transcript under THIS payload's session_id, so it runs only on a manual invocation (no payload).
     let transcriptPath;
     if (payloadTranscriptPath !== null) {
         if (isReadableFile(payloadTranscriptPath)) {
@@ -246,7 +242,7 @@ function resolvePreCompactTranscript(payloadTranscriptPath, stdinText, logFile)
 }
 function saveDerivedSnapshot(hippoRoot, logFile, sessionId, recordId, derived) {
     const tenantId = resolveTenantId({});
-    // Per-field merge (X1): a tool-heavy tail whose only user turns are
+    // Per-field merge: a tool-heavy tail whose only user turns are
     // tool_result arrays derives an empty task even though the summary is
     // non-empty. Loading the existing snapshot first lets each field fall
     // back independently instead of the whole write clobbering a
@@ -258,7 +254,7 @@ function saveDerivedSnapshot(hippoRoot, logFile, sessionId, recordId, derived) {
     catch {
         // No existing snapshot to merge against — proceed with derived-only.
     }
-    // CX6 (codex round 2): field fallback must never move content across
+    // Field fallback must never move content across
     // sessions — session A's task carried into a snapshot saved under session
     // B's id would pass compact-resume's session gate wearing the wrong
     // badge. Fall back only when the existing snapshot has no session, this
@@ -335,7 +331,7 @@ export function cmdPostCompact(hippoRoot, options) {
             storeBusy = saved.deferred;
             if (!storeBusy && payload.transcriptPath !== null && options.afterSave) {
                 try {
-                    options.afterSave(payload.transcriptPath, compactionOrigin(hippoRoot, payload.cwd), log);
+                    options.afterSave(payload.transcriptPath, payload.cwd, log);
                 }
                 catch (err) {
                     log(`agent memory import failed: ${errorMessage(err)}`);