hippo-memory 1.62.0 → 1.63.0

package/dist/eval-suite.js

@@ -37,17 +37,13 @@ function mem(id, content, opts = {}) {
         entry.created = opts.created;
     return entry;
 }
-export function buildSyntheticCorpus() {
-    const entries = [];
-    const cases = [];
-    // =========================================================================
-    // 1. DIRECT RECALL — basic keyword matching
-    // =========================================================================
+/** Direct recall: basic keyword matching. */
+function addDirectRecall(entries, cases) {
     entries.push(mem('dr-1', 'The PostgreSQL database migration failed because the users table had a NOT NULL constraint on the email column', { created: dateOffset(1), tags: ['topic:database'] }), mem('dr-2', 'React component rendering performance improved by 40% after memoizing the expensive computation in useMemo', { created: dateOffset(2), tags: ['topic:frontend'] }), mem('dr-3', 'The API rate limiter should use a sliding window algorithm instead of fixed window to prevent burst traffic', { created: dateOffset(3), tags: ['topic:api'] }), mem('dr-4', 'Docker container memory limits need to be set to 512MB for the worker service to prevent OOM kills', { created: dateOffset(4), tags: ['topic:devops'] }), mem('dr-5', 'The JWT token expiration was set to 24 hours but should be reduced to 1 hour for security compliance', { created: dateOffset(5), tags: ['topic:security'] }), mem('dr-6', 'Webpack bundle size grew to 2.3MB because lodash was imported as a whole instead of cherry-picking', { created: dateOffset(6), tags: ['topic:frontend'] }), mem('dr-7', 'The Redis cache TTL for user sessions should match the JWT expiration to prevent stale sessions', { created: dateOffset(7), tags: ['topic:caching'] }), mem('dr-8', 'GraphQL resolver for nested comments has N+1 query problem solved by DataLoader batching', { created: dateOffset(8), tags: ['topic:api'] }));
     cases.push({ id: 'dr-q1', category: 'direct-recall', query: 'PostgreSQL migration NOT NULL constraint', expectedIds: ['dr-1'], description: 'exact keyword match on DB migration' }, { id: 'dr-q2', category: 'direct-recall', query: 'React useMemo performance memoizing', expectedIds: ['dr-2'], description: 'React performance optimization' }, { id: 'dr-q3', category: 'direct-recall', query: 'sliding window rate limiter API', expectedIds: ['dr-3'], description: 'API rate limiting approach' }, { id: 'dr-q4', category: 'direct-recall', query: 'Docker OOM memory limits worker', expectedIds: ['dr-4'], description: 'Docker memory config' }, { id: 'dr-q5', category: 'direct-recall', query: 'JWT token expiration security', expectedIds: ['dr-5'], description: 'JWT security setting' }, { id: 'dr-q6', category: 'direct-recall', query: 'webpack bundle size lodash', expectedIds: ['dr-6'], description: 'bundle size issue' }, { id: 'dr-q7', category: 'direct-recall', query: 'Redis cache TTL session expiration', expectedIds: ['dr-7'], description: 'cache TTL config' }, { id: 'dr-q8', category: 'direct-recall', query: 'GraphQL N+1 DataLoader batching', expectedIds: ['dr-8'], description: 'GraphQL N+1 fix' });
-    // =========================================================================
-    // 2. EXTRACTION PREFERENCE — extracted facts should rank above raw source
-    // =========================================================================
+}
+/** Extraction preference: extracted facts should rank above raw source. */
+function addExtractionPreference(entries, cases) {
     entries.push(mem('ep-src-1', 'speaker:Alice: So we had this big meeting yesterday about the deployment pipeline and Bob mentioned that the staging environment is using Kubernetes 1.28 and we should upgrade to 1.30 before the end of Q2 because of the security patches', {
         created: dateOffset(10), tags: ['speaker:Alice', 'topic:infrastructure', 'session:meeting-1'],
     }), mem('ep-ext-1', 'The staging environment runs Kubernetes 1.28 and needs to be upgraded to 1.30 before end of Q2 for security patches', {
@@ -65,9 +61,9 @@ export function buildSyntheticCorpus() {
         extracted_from: 'ep-src-3',
     }));
     cases.push({ id: 'ep-q1', category: 'extraction-preference', query: 'Kubernetes upgrade staging environment', expectedIds: ['ep-ext-1'], description: 'extracted fact about K8s upgrade should rank above raw utterance' }, { id: 'ep-q2', category: 'extraction-preference', query: 'Datadog Grafana alerting migration', expectedIds: ['ep-ext-2'], description: 'extracted fact about monitoring switch' }, { id: 'ep-q3', category: 'extraction-preference', query: 'OAuth2 PKCE login page redesign', expectedIds: ['ep-ext-3'], description: 'extracted fact about auth work' });
-    // =========================================================================
-    // 3. DAG DRILL-DOWN — summary nodes should surface children
-    // =========================================================================
+}
+/** Dag drill-down: summary nodes should surface children. */
+function addDagDrilldown(entries, cases) {
     entries.push(mem('dag-child-1', 'The API response time for /users endpoint degraded from 50ms to 300ms after adding the permissions check', {
         created: dateOffset(15), layer: Layer.Semantic, tags: ['topic:api-performance', 'extracted'],
         dag_level: 1,
@@ -86,14 +82,14 @@ export function buildSyntheticCorpus() {
         child.dag_parent_id = 'dag-summary-1';
     }
     cases.push({ id: 'dag-q1', category: 'dag-drilldown', query: 'API performance problems latency', expectedIds: ['dag-child-1', 'dag-child-2', 'dag-child-3', 'dag-summary-1'], description: 'summary should drill down to all children' }, { id: 'dag-q2', category: 'dag-drilldown', query: 'endpoint response time degradation', expectedIds: ['dag-child-1', 'dag-child-2', 'dag-summary-1'], description: 'query matching summary should surface relevant children' });
-    // =========================================================================
-    // 4. TEMPORAL — recency/oldest cues should affect ranking
-    // =========================================================================
+}
+/** Temporal: recency/oldest cues should affect ranking. */
+function addTemporal(entries, cases) {
     entries.push(mem('tmp-1', 'The team decided to use TypeScript for the new service', { created: dateOffset(-30), tags: ['topic:architecture'] }), mem('tmp-2', 'The team evaluated Rust as an alternative language for the service', { created: dateOffset(-20), tags: ['topic:architecture'] }), mem('tmp-3', 'The team added Go as a candidate language for the service rewrite', { created: dateOffset(-10), tags: ['topic:architecture'] }), mem('tmp-4', 'The team finalized the language choice as Go for the service rewrite', { created: dateOffset(-1), tags: ['topic:architecture'] }));
     cases.push({ id: 'tmp-q1', category: 'temporal', query: 'what did the team recently decide about the service language', expectedIds: ['tmp-4'], description: 'recent cue should boost newest entry' }, { id: 'tmp-q2', category: 'temporal', query: 'what was the first language choice for the service', expectedIds: ['tmp-1'], description: 'oldest cue should boost earliest entry' }, { id: 'tmp-q3', category: 'temporal', query: 'latest update on the service rewrite language', expectedIds: ['tmp-4'], description: 'latest should boost most recent' }, { id: 'tmp-q4', category: 'temporal', query: 'original architecture decision for the service', expectedIds: ['tmp-1'], description: 'original should boost earliest' });
-    // =========================================================================
-    // 5. NOISE RESISTANCE — relevant memories found despite noise
-    // =========================================================================
+}
+/** Noise resistance: relevant memories found despite noise. */
+function addNoiseResistance(entries, cases) {
     // Add 30 noise entries
     const noiseTopics = [
         'breakfast meeting catering ordered sandwiches', 'office temperature thermostat adjusted',
@@ -121,9 +117,9 @@ export function buildSyntheticCorpus() {
         created: dateOffset(21), tags: ['topic:security', 'topic:s3'],
     }));
     cases.push({ id: 'nr-q1', category: 'noise-resistance', query: 'database connection pool exhausted max connections', expectedIds: ['nr-1'], description: 'find DB issue despite 30 noise entries' }, { id: 'nr-q2', category: 'noise-resistance', query: 'S3 bucket public access security misconfiguration', expectedIds: ['nr-2'], description: 'find S3 issue despite noise' }, { id: 'nr-q3', category: 'noise-resistance', query: 'PostgreSQL migration constraint', expectedIds: ['dr-1'], description: 'find earlier DB entry despite noise' }, { id: 'nr-q4', category: 'noise-resistance', query: 'JWT token security expiration', expectedIds: ['dr-5'], description: 'find security entry despite noise' });
-    // =========================================================================
-    // 6. MULTI-HOP — entity chaining across sessions
-    // =========================================================================
+}
+/** Multi-hop: entity chaining across sessions. */
+function addMultiHop(entries, cases) {
     entries.push(mem('mh-1', 'speaker:Alice works on the payment gateway integration with Stripe. She found a webhook signature validation bug.', {
         created: dateOffset(25), tags: ['speaker:Alice', 'topic:payments'],
     }), mem('mh-2', 'speaker:Bob reviewed the Stripe webhook code and confirmed the signature validation uses the wrong secret key from the test environment.', {
@@ -134,6 +130,16 @@ export function buildSyntheticCorpus() {
         created: dateOffset(28), tags: ['speaker:Carol', 'topic:billing'],
     }));
     cases.push({ id: 'mh-q1', category: 'multi-hop', query: 'Who fixed the Stripe webhook bug and what was the root cause?', expectedIds: ['mh-1', 'mh-2', 'mh-3'], description: 'chain Alice -> Stripe -> Bob -> fix' }, { id: 'mh-q2', category: 'multi-hop', query: 'What are all the payment-related issues the team discussed?', expectedIds: ['mh-1', 'mh-2', 'mh-3', 'mh-4'], description: 'find all payment topics across speakers' });
+}
+export function buildSyntheticCorpus() {
+    const entries = [];
+    const cases = [];
+    addDirectRecall(entries, cases);
+    addExtractionPreference(entries, cases);
+    addDagDrilldown(entries, cases);
+    addTemporal(entries, cases);
+    addNoiseResistance(entries, cases);
+    addMultiHop(entries, cases);
     return { entries, cases };
 }
 // ---------------------------------------------------------------------------

package/dist/extract.js

@@ -6,9 +6,7 @@ import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { neverAutoShareTags } from './shared.js';
 import { log } from './log.js';
-function isJsonString(value) {
-    return typeof value === 'string';
-}
+import { isJsonString } from './json.js';
 const EXTRACTION_PROMPT = `You are extracting factual statements from a conversation or memory entry. Extract 1-8 standalone factual statements that would be useful to remember later.
 
 Rules:
@@ -101,15 +99,12 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
                 source: source.source,
                 extracted_from: source.id,
                 scope: source.scope,
-                // T1 executor check (2026-08-15 hardening pass): same defect as the
-                // consolidate.ts merge/trace passes — createMemory with no tenantId
-                // option stamps 'default' (memory.ts:535) regardless of the source
-                // entry's own tenant. Thread it through so extracted facts land in
-                // the same tenant as the episodic memory they were extracted from.
+                // Without it createMemory stamps 'default', and extracted facts leave
+                // the tenant of the episodic memory they were extracted from.
                 tenantId: source.tenantId,
                 baseHalfLifeDays,
             }), origin_project: source.origin_project };
-        // AT1 containment: a refusal is per-VALUE — one rejected fact must not
+        // A refusal is per-VALUE: one rejected fact must not
         // drop the rest of this batch. writeEntry has already audited the
         // refusal (reject_refusal) before rethrowing, so skip-and-count here.
         try {

package/dist/failure-log.d.ts

@@ -1,4 +1,4 @@
-/** Failure log (ROADMAP CD13): every failed tool call the capture-error hook sees, stored or not. */
+/** Failure log: every failed tool call the capture-error hook sees, stored or not. */
 import type { CaptureErrorOutcome, RoutineRule } from './capture-error.js';
 import type { DatabaseSyncLike } from './db.js';
 /** Rows older than this are pruned on write, which also bounds how far back a repeat can be found. */
@@ -31,9 +31,9 @@ export interface SessionFailures {
     /** Of those, failures whose signature another session hit first. */
     repeats: number;
 }
-/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm. */
 export declare function failuresBySession(db: DatabaseSyncLike, tenantId: string, sinceIso: string): SessionFailures[];
-/** Failure log totals over a window, for {@link summarizeFailures}. Counts only: a rate needs a holdout arm (CD11). */
+/** Failure log totals over a window, for {@link summarizeFailures}. Counts only: a rate needs a holdout arm. */
 export interface FailureSummary {
     /** ISO start of the window (inclusive). */
     since: string;

package/dist/failure-log.js

@@ -11,7 +11,7 @@ export function recordFailure(db, event) {
     const cutoff = new Date(Date.parse(now) - FAILURE_LOG_RETENTION_DAYS * 86_400_000).toISOString();
     db.prepare(`DELETE FROM failure_log WHERE ts < ?`).run(cutoff);
 }
-/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm. */
 export function failuresBySession(db, tenantId, sinceIso) {
     // SAFETY: the SELECT names exactly these three TEXT columns.
     const rows = db.prepare(`SELECT ts, session_id, sig_hash FROM failure_log

package/dist/forward-claim-detector.d.ts

@@ -1,5 +1,5 @@
 /**
- * J3.2 forward-claim detector — pure-function regex set + token extraction.
+ * Forward-claim detector: pure-function regex set + token extraction.
  *
  * No DB. No state. No dependencies beyond stdlib regex + String.
  *
@@ -13,9 +13,7 @@
  * Iteration signal: the `recall_autodebias_hint_no_class_match` audit op
  * (emitted by computePlanningFallacyOutput when a phrase matches but no class
  * resolves) is the telemetry channel for deciding whether to add an
- * embedding-based detector in J3.3.
- *
- * Plan: docs/plans/2026-05-26-j32-auto-injection.md (Task 1).
+ * embedding-based detector.
  */
 export interface ForwardClaimMatch {
     /** The regex match snippet, e.g. "will take" or "~3 days". Surfaced

package/dist/forward-claim-detector.js

@@ -1,5 +1,5 @@
 /**
- * J3.2 forward-claim detector — pure-function regex set + token extraction.
+ * Forward-claim detector: pure-function regex set + token extraction.
  *
  * No DB. No state. No dependencies beyond stdlib regex + String.
  *
@@ -13,12 +13,10 @@
  * Iteration signal: the `recall_autodebias_hint_no_class_match` audit op
  * (emitted by computePlanningFallacyOutput when a phrase matches but no class
  * resolves) is the telemetry channel for deciding whether to add an
- * embedding-based detector in J3.3.
- *
- * Plan: docs/plans/2026-05-26-j32-auto-injection.md (Task 1).
+ * embedding-based detector.
  */
 /**
- * Patterns ship-locked at v1.13.x. Each pattern is intentionally narrow —
+ * Each pattern is intentionally narrow:
  * adding a pattern should require evidence from the
  * `recall_autodebias_hint_no_class_match` audit channel that real forward-
  * claims are slipping through, NOT speculative "this might match more".
@@ -29,8 +27,7 @@
  */
 // Reused fragment for ALL duration-suffix patterns. Requires a digit + unit
 // so 'will take ownership' / 'ship in Docker' (no time component) don't
-// match. Codex round 2 P2: patterns that allowed verb-only matches fired
-// on every-day non-estimate queries that happened to share a class-token.
+// match: verb-only patterns fire on everyday non-estimate queries that share a class-token.
 // Accepts `<N> unit` (3 days), `a/an unit` (a week — implicit 1), and
 // `one unit` so natural English forward-claims aren't lost.
 const DURATION_TAIL = String.raw `(?:about|around|~|≈)?\s*(?:\d+|a|an|one)\s*(?:day|week|month|hour|hr|min(?:ute)?|sec(?:ond)?)s?\b`;
@@ -51,8 +48,7 @@ const FORWARD_CLAIM_PATTERNS = [
     // Lookbehind asserts start-of-string OR whitespace before the tilde
     // because \b before ~ requires a word char immediately preceding (~ is
     // not a word character), so /\b~/ would only match in 'foo~3 days'
-    // (malformed) and silently miss the legitimate cases. Codex review
-    // round 1 catch.
+    // (malformed) and silently miss the legitimate cases.
     /(?<=^|\s)~\s*\d+\s*(?:day|week|month|hour)s?\b/i,
     // Should + verb + duration tail. Same tightening as the leading 'will
     // take' rule: 'should ship by EOD' must include a quantifier.
@@ -78,8 +74,7 @@ const STOP_WORDS = new Set([
     // Duration units appear in every forward-claim phrase by design (the
     // regex set REQUIRES a `<N> <unit>` quantifier after the verb). Letting
     // them through to class resolution lets a class tag containing 'days'
-    // win or tie on the unit token instead of the domain token. Codex round
-    // 2 P3 catch.
+    // win or tie on the unit token instead of the domain token.
     'day', 'days', 'week', 'weeks', 'month', 'months',
     'hour', 'hours', 'hr', 'hrs',
     'min', 'mins', 'minute', 'minutes', 'sec', 'secs', 'second', 'seconds',

package/dist/goals.d.ts

@@ -60,7 +60,7 @@ export interface PushGoalOpts {
 }
 export declare function pushGoal(hippoRoot: string, opts: PushGoalOpts): Goal;
 /**
- * v1.7.4 — depth-cap enforcer extracted from pushGoalWithDb and resumeGoal.
+ * Depth-cap enforcer shared by pushGoalWithDb and resumeGoal.
  * If the (tenant, session) has >= MAX_ACTIVE_GOAL_DEPTH active goals,
  * suspend the oldest `overflow` ones.
  *
@@ -69,7 +69,7 @@ export declare function pushGoal(hippoRoot: string, opts: PushGoalOpts): Goal;
  * is impossible to misread the contract at a call site. Both existing call
  * sites (pushGoalWithDb, resumeGoal) wrap in `BEGIN IMMEDIATE` already.
  *
- * @internal v1.7.4 -- internal goal-stack invariant. Subject to change.
+ * @internal Internal goal-stack invariant. Subject to change.
  */
 export declare function enforceDepthCapWithinTx(db: DatabaseSyncLike, tenantId: string, sessionId: string): void;
 export declare function pushGoalWithDb(db: DatabaseSyncLike, opts: PushGoalOpts): Goal;
@@ -148,7 +148,7 @@ export declare function applyGoalStackBoost<R extends {
 export interface CompleteGoalOpts {
     outcomeScore?: number;
     /**
-     * v1.7.4 — when true, skip the strength-multiplier propagation block.
+     * When true, skip the strength-multiplier propagation block.
      * Default false (propagate). The goal's status still transitions to
      * 'completed' and `outcome_score` is still recorded; only the side-effect
      * on recalled memories' strength is suppressed.

package/dist/goals.js

@@ -29,7 +29,7 @@ export function pushGoal(hippoRoot, opts) {
     }
 }
 /**
- * v1.7.4 — depth-cap enforcer extracted from pushGoalWithDb and resumeGoal.
+ * Depth-cap enforcer shared by pushGoalWithDb and resumeGoal.
  * If the (tenant, session) has >= MAX_ACTIVE_GOAL_DEPTH active goals,
  * suspend the oldest `overflow` ones.
  *
@@ -38,7 +38,7 @@ export function pushGoal(hippoRoot, opts) {
  * is impossible to misread the contract at a call site. Both existing call
  * sites (pushGoalWithDb, resumeGoal) wrap in `BEGIN IMMEDIATE` already.
  *
- * @internal v1.7.4 -- internal goal-stack invariant. Subject to change.
+ * @internal Internal goal-stack invariant. Subject to change.
  */
 export function enforceDepthCapWithinTx(db, tenantId, sessionId) {
     // SAFETY: the row comes from the SELECT above, which projects exactly one
@@ -291,9 +291,8 @@ export function computeGoalStackBoost(db, results, opts) {
         if (matches.length === 0)
             return r;
         const multiplier = goalBoostMultiplier(r.entry, tags, matches, goalsByTag, policiesByGoalId);
-        // A7 recall-trace side-channel: record the goal-boost step BEFORE the
-        // score is mutated, keyed by entry id. Pure read of r.score here; the
-        // mutation below is byte-identical to pre-A7.
+        // Recall-trace side-channel: record the goal-boost step BEFORE the
+        // score is mutated, keyed by entry id; a pure read of r.score.
         if (trace) {
             trace.set(r.entry.id, {
                 stage: 'goal-boost',
@@ -309,7 +308,7 @@ export function computeGoalStackBoost(db, results, opts) {
         // still satisfies R's shape exactly.
         return { ...r, score: r.score * multiplier };
     })
-        // T2 note: deliberately a PLAIN stable score sort, no compareEntryIdentity
+        // Deliberately a PLAIN stable score sort, no compareEntryIdentity
         // tail -- a re-sort of an already deterministically-ordered ranking
         // inherits its determinism via sort stability, and ties preserve the
         // prior (meaningful) rank instead of reordering by content.

package/dist/graph/read.d.ts

@@ -16,7 +16,7 @@ export declare function loadRelations(hippoRoot: string, tenantId: string, opts?
     limit?: number;
 }, txDb?: GraphTxDb): Relation[];
 /**
- * Map consolidated source memory ids -> their graph entities. The SEED step of E3.2
+ * Map consolidated source memory ids -> their graph entities. The SEED step of
  * multi-hop recall (recall result memory ids -> entities to traverse from). Tenant-
  * scoped, read-only; chunks the IN-list under the SQLite variable cap.
  */
@@ -28,7 +28,7 @@ export declare function loadEntitiesByMemoryId(hippoRoot: string, tenantId: stri
 export declare function loadEntitiesByIds(hippoRoot: string, tenantId: string, ids: number[], txDb?: GraphTxDb): Entity[];
 /**
  * All relations touching ANY of `entityIds` in EITHER direction (from OR to) — the
- * per-hop neighbour query for E3.2 multi-hop traversal. ONE query for the whole frontier
+ * per-hop neighbour query for multi-hop traversal. ONE query for the whole frontier
  * (not one per node): this is the bidirectional read `loadRelations` (from-only) lacks,
  * and avoids an N+1 across BFS frontier nodes. `limit` caps rows for the frontier and
  * must be a non-negative integer (the raw `LIMIT ?` rejects a fractional value).

package/dist/graph/read.js

@@ -98,14 +98,14 @@ export function loadRelations(hippoRoot, tenantId, opts = {}, txDb) {
     }
 }
 // ---------------------------------------------------------------------------
-// E3.2 multi-hop recall read helpers (SELECT-only; the check-graph-writes lint
+// Multi-hop recall read helpers (SELECT-only; the check-graph-writes lint
 // permits these here and in the read-only consumer src/graph-recall.ts).
 // ---------------------------------------------------------------------------
 /** Chunk size for IN-list queries: well under SQLite's 999-bound-variable default
  *  (leaves headroom for the tenant_id param + the doubled list in neighbour lookups). */
 const IN_LIST_CHUNK = 400;
 /**
- * Map consolidated source memory ids -> their graph entities. The SEED step of E3.2
+ * Map consolidated source memory ids -> their graph entities. The SEED step of
  * multi-hop recall (recall result memory ids -> entities to traverse from). Tenant-
  * scoped, read-only; chunks the IN-list under the SQLite variable cap.
  */
@@ -119,8 +119,7 @@ export function loadEntitiesByMemoryId(hippoRoot, tenantId, memoryIds) {
         for (let i = 0; i < memoryIds.length; i += IN_LIST_CHUNK) {
             const slice = memoryIds.slice(i, i + IN_LIST_CHUNK);
             const ph = slice.map(() => '?').join(',');
-            // T2: no ORDER BY meant chunk-local scan order decided ties; id ASC
-            // makes it deterministic (entities.id is an autoincrement integer PK).
+            // id ASC so chunk-local scan order never decides ties (id is an autoincrement PK).
             // SAFETY: rows' shape matches the columns named in ENTITY_COLS above.
             const rows = db.prepare(`
         SELECT ${ENTITY_COLS} FROM entities
@@ -166,7 +165,7 @@ export function loadEntitiesByIds(hippoRoot, tenantId, ids, txDb) {
 }
 /**
  * All relations touching ANY of `entityIds` in EITHER direction (from OR to) — the
- * per-hop neighbour query for E3.2 multi-hop traversal. ONE query for the whole frontier
+ * per-hop neighbour query for multi-hop traversal. ONE query for the whole frontier
  * (not one per node): this is the bidirectional read `loadRelations` (from-only) lacks,
  * and avoids an N+1 across BFS frontier nodes. `limit` caps rows for the frontier and
  * must be a non-negative integer (the raw `LIMIT ?` rejects a fractional value).
@@ -183,7 +182,7 @@ export function loadNeighborRelations(hippoRoot, tenantId, entityIds, opts = {},
     const db = txDb ?? ownDb;
     try {
         // `limit` is applied PER CHUNK; a frontier spanning >IN_LIST_CHUNK ids could return
-        // up to limit*chunks rows before the by-id dedup below. Harmless for E3.2 (the
+        // up to limit*chunks rows before the by-id dedup below. Harmless for multi-hop recall (the
         // frontier is bounded by maxNeighbors <= 200 << IN_LIST_CHUNK, so a single chunk,
         // and the BFS re-enforces the per-hop fanout cap), but note the semantics if a
         // tighter total cap is ever needed.

package/dist/graph/types.d.ts

@@ -8,10 +8,10 @@ export type RelationType = 'owns' | 'supersedes' | 'depends-on' | 'blocked-by' |
 export type GraphQueueStatus = 'pending' | 'processed' | 'skipped';
 /** The consolidated source kinds the graph is permitted to index (never 'raw'). */
 export type SourceKind = 'distilled' | 'superseded';
-/** The authoritative E2 object types a graph row may be anchored to (the object
+/** The authoritative first-class object types a graph row may be anchored to (the object
  *  provenance path, alongside the memory path). Maps to source_object_type. */
 export type SourceObjectType = 'decision' | 'policy' | 'customer' | 'project';
-/** A soft (type,id) pointer to the authoritative E2 row a graph row descends from.
+/** A soft (type,id) pointer to the authoritative object row a graph row descends from.
  *  Survives a mirror memory forget/prune (memory_id may go NULL); the rebuild
  *  re-validates it (it is not a hard FK). */
 export interface SourceObjectRef {
@@ -32,8 +32,8 @@ export interface Entity {
      *  its source_object provenance. */
     memoryId: string | null;
     sourceKind: SourceKind;
-    /** The authoritative E2 object this entity is anchored to (E2-provenance path).
-     *  Set for E2-sourced entities; absent for memory-only (prose/NLP) entities. */
+    /** The authoritative object this entity is anchored to (object-provenance path).
+     *  Set for object-sourced entities; absent for memory-only (prose/NLP) entities. */
     sourceObjectType?: SourceObjectType;
     sourceObjectId?: number;
     createdAt: string;
@@ -64,9 +64,9 @@ export interface InsertEntityOpts {
     entityType: EntityType;
     name: string;
     /** A consolidated (distilled/superseded) memory; raw is rejected. NULL/omitted when
-     *  the entity is anchored only to its E2 source object (mirror forgotten/pruned). */
+     *  the entity is anchored only to its source object (mirror forgotten/pruned). */
     memoryId?: string | null;
-    /** The authoritative E2 object this entity descends from. Required when memoryId is
+    /** The authoritative object this entity descends from. Required when memoryId is
      *  null; optional alongside a live memory (both paths may be set). */
     sourceObject?: SourceObjectRef;
 }
@@ -75,9 +75,9 @@ export interface InsertRelationOpts {
     toEntityId: number;
     relType: RelationType;
     /** A consolidated (distilled/superseded) memory; raw is rejected. NULL/omitted when
-     *  the relation is anchored only to its E2 source object. */
+     *  the relation is anchored only to its source object. */
     memoryId?: string | null;
-    /** The authoritative E2 object this relation descends from. */
+    /** The authoritative object this relation descends from. */
     sourceObject?: SourceObjectRef;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/graph/write.d.ts

@@ -1,6 +1,5 @@
 /**
- * E3.3 graph layer over consolidated state - the graph-on-consolidated guard.
- * (docs/plans/2026-06-01-e3-graph-guard.md).
+ * Graph layer over consolidated state - the graph-on-consolidated guard.
  *
  * A graph of canonical `entities` (person/project/customer/system/policy/decision) and
  * `relations` (owns/supersedes/depends-on/blocked-by/references) sits ON TOP OF
@@ -11,11 +10,6 @@
  * actual kind and enforce tenant-match - relations also reject cross-tenant edges), so
  * the forbidden state is unrepresentable regardless of code path. These helpers
  * surface the same guard as clear throws BEFORE hitting the trigger backstop.
- *
- * Scope (E3.3 first slice): the substrate + the guard + a thin insert/load/enqueue
- * API. The `graph_extraction_queue` is the interface the deferred `hippo sleep`
- * enqueue-hook + E3.1 entity extraction will call. No operator surface (CLI/HTTP/SDK)
- * until E3.2 multi-hop recall.
  */
 import { type GraphTxDb, type SourceObjectType, type Entity, type Relation, type GraphQueueItem, type InsertEntityOpts, type InsertRelationOpts } from './types.js';
 /**
@@ -30,8 +24,7 @@ export declare function insertEntity(hippoRoot: string, tenantId: string, opts:
 export declare function insertRelation(hippoRoot: string, tenantId: string, opts: InsertRelationOpts, txDb?: GraphTxDb): Relation;
 /**
  * Enqueue a consolidated memory for later graph extraction. Rejects a raw / missing /
- * cross-tenant memory (the DB trigger is the backstop). The producer hook in
- * `hippo sleep` is deferred (E3.1); this is the API it will call.
+ * cross-tenant memory (the DB trigger is the backstop).
  */
 export declare function enqueueExtraction(hippoRoot: string, tenantId: string, memoryId: string): GraphQueueItem;
 /**
@@ -46,7 +39,7 @@ export declare function markExtractionProcessed(hippoRoot: string, tenantId: str
  * the number of entities deleted. The rebuild primitive for graph extraction: the
  * deterministic graph is a pure derived function of the consolidated objects, so an
  * extract clears then re-derives. Lives in graph.ts (the sole sanctioned graph
- * writer), so the E3.3 CI lint permits this `DELETE FROM entities`. Does NOT touch
+ * writer), so the CI lint permits this `DELETE FROM entities`. Does NOT touch
  * graph_extraction_queue (the enqueue-hook's domain).
  */
 export declare function clearGraph(hippoRoot: string, tenantId: string, txDb?: GraphTxDb): number;
@@ -63,19 +56,19 @@ export declare function runGraphRebuildTransaction<T>(hippoRoot: string, tenantI
 /**
  * Fail-soft producer hook: mark a tenant dirty for graph re-extraction by
  * enqueuing its consolidated mirror memory. NEVER throws into the caller — a
- * graph-dirty signal failing must not abort a core E2 write. Graph staleness is
+ * graph-dirty signal failing must not abort a core object write. Graph staleness is
  * recoverable (next sleep / manual `graph extract`); a broken `hippo decide` is
- * not. Called POST-COMMIT from the E2 graph-source save/close mutations of
+ * not. Called POST-COMMIT from the graph-source save/close mutations of
  * decision, policy, customer_note and project_brief. A null memoryId (a
  * forgotten mirror) is a no-op.
  */
 export declare function markGraphDirty(hippoRoot: string, tenantId: string, memoryId: string | null): void;
 /**
- * Remove the graph rows sourced from one E2 object, by its (type, id). Used when a
+ * Remove the graph rows sourced from one first-class object, by its (type, id). Used when a
  * MIRRORLESS object is closed: it has no mirror memory, so `markGraphDirty` cannot
  * enqueue a rebuild (the queue is memory-keyed). Closing must still drop the object's
  * now-stale entity + edges from the graph, so we remove them directly here. Fail-soft
- * like `markGraphDirty` (never throws into the E2 close caller; graph staleness is
+ * like `markGraphDirty` (never throws into the object close caller; graph staleness is
  * recoverable). Deleting the entity cascade-deletes any relation where it is an endpoint
  * (relations FK entities ON DELETE CASCADE); the explicit relations DELETE also covers a
  * relation whose OWN provenance is this object (defensive — every such edge has the object

package/dist/graph/write.js

@@ -1,6 +1,5 @@
 /**
- * E3.3 graph layer over consolidated state - the graph-on-consolidated guard.
- * (docs/plans/2026-06-01-e3-graph-guard.md).
+ * Graph layer over consolidated state - the graph-on-consolidated guard.
  *
  * A graph of canonical `entities` (person/project/customer/system/policy/decision) and
  * `relations` (owns/supersedes/depends-on/blocked-by/references) sits ON TOP OF
@@ -11,11 +10,6 @@
  * actual kind and enforce tenant-match - relations also reject cross-tenant edges), so
  * the forbidden state is unrepresentable regardless of code path. These helpers
  * surface the same guard as clear throws BEFORE hitting the trigger backstop.
- *
- * Scope (E3.3 first slice): the substrate + the guard + a thin insert/load/enqueue
- * API. The `graph_extraction_queue` is the interface the deferred `hippo sleep`
- * enqueue-hook + E3.1 entity extraction will call. No operator surface (CLI/HTTP/SDK)
- * until E3.2 multi-hop recall.
  */
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { assertTenantId } from '../tenant.js';
@@ -37,9 +31,9 @@ function resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, label)
         const row = db.prepare(`SELECT kind, tenant_id FROM memories WHERE id = ?`).get(memoryId);
         if (!row) {
             // Stale / forgotten mirror. Tolerate it IFF a valid source object provides provenance:
-            // graph-extract reads E2 rows then inserts, and a mirror forgotten/pruned in that window
-            // must NOT roll back the whole tenant rebuild - the active E2 object survives mirror loss
-            // (v38 contract; codex round-4 race). Anchor to the object; drop the dead memory pointer.
+            // graph-extract reads object rows then inserts, and a mirror forgotten/pruned in that window
+            // must NOT roll back the whole tenant rebuild - the active object survives mirror loss.
+            // Anchor to the object; drop the dead memory pointer.
             if (sourceObject == null) {
                 throw new Error(`${label}: source memory ${memoryId} not found`);
             }
@@ -58,8 +52,8 @@ function resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, label)
             memKind = row.kind;
         }
     }
-    // Validate the object pointer WHENEVER it is provided - not only when memory is null
-    // (codex review): a dual-set row whose object is wrong/closed/cross-tenant would become
+    // Validate the object pointer WHENEVER it is provided, not only when memory is null:
+    // a dual-set row whose object is wrong/closed/cross-tenant would become
     // the active provenance after ON DELETE SET NULL and could then block the memory delete.
     if (sourceObject != null) {
         const table = SOURCE_OBJECT_TABLE[sourceObject.type];
@@ -79,7 +73,7 @@ function resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, label)
         }
     }
     // source_kind is the memory's kind when a memory is present, else 'distilled' for an
-    // object-only row (E2 objects are consolidated by construction). All-null is rejected.
+    // object-only row (objects are consolidated by construction). All-null is rejected.
     if (memKind != null)
         return { sourceKind: memKind, memoryId: effectiveMemoryId };
     if (sourceObject != null)
@@ -170,12 +164,11 @@ export function insertRelation(hippoRoot, tenantId, opts, txDb) {
     }
 }
 // ---------------------------------------------------------------------------
-// Extraction queue (the interface the deferred sleep enqueue-hook + E3.1 will use)
+// Extraction queue
 // ---------------------------------------------------------------------------
 /**
  * Enqueue a consolidated memory for later graph extraction. Rejects a raw / missing /
- * cross-tenant memory (the DB trigger is the backstop). The producer hook in
- * `hippo sleep` is deferred (E3.1); this is the API it will call.
+ * cross-tenant memory (the DB trigger is the backstop).
  */
 export function enqueueExtraction(hippoRoot, tenantId, memoryId) {
     assertTenantId('enqueueExtraction', tenantId);
@@ -241,7 +234,7 @@ export function markExtractionProcessed(hippoRoot, tenantId, id, status = 'proce
  * the number of entities deleted. The rebuild primitive for graph extraction: the
  * deterministic graph is a pure derived function of the consolidated objects, so an
  * extract clears then re-derives. Lives in graph.ts (the sole sanctioned graph
- * writer), so the E3.3 CI lint permits this `DELETE FROM entities`. Does NOT touch
+ * writer), so the CI lint permits this `DELETE FROM entities`. Does NOT touch
  * graph_extraction_queue (the enqueue-hook's domain).
  */
 export function clearGraph(hippoRoot, tenantId, txDb) {
@@ -292,14 +285,14 @@ export function runGraphRebuildTransaction(hippoRoot, tenantId, fn) {
     }
 }
 // ---------------------------------------------------------------------------
-// E3 sleep enqueue-hook — producer helper + drain support
+// Sleep enqueue-hook: producer helper + drain support
 // ---------------------------------------------------------------------------
 /**
  * Fail-soft producer hook: mark a tenant dirty for graph re-extraction by
  * enqueuing its consolidated mirror memory. NEVER throws into the caller — a
- * graph-dirty signal failing must not abort a core E2 write. Graph staleness is
+ * graph-dirty signal failing must not abort a core object write. Graph staleness is
  * recoverable (next sleep / manual `graph extract`); a broken `hippo decide` is
- * not. Called POST-COMMIT from the E2 graph-source save/close mutations of
+ * not. Called POST-COMMIT from the graph-source save/close mutations of
  * decision, policy, customer_note and project_brief. A null memoryId (a
  * forgotten mirror) is a no-op.
  */
@@ -311,16 +304,16 @@ export function markGraphDirty(hippoRoot, tenantId, memoryId) {
     }
     catch (err) {
         // Logged (warn) so a SYSTEMATIC enqueue failure surfaces to operators, but
-        // swallowed so the already-committed E2 write is never rolled back.
+        // swallowed so the already-committed object write is never rolled back.
         log.warn(`markGraphDirty: enqueue failed for tenant=${tenantId} memory=${memoryId}: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**
- * Remove the graph rows sourced from one E2 object, by its (type, id). Used when a
+ * Remove the graph rows sourced from one first-class object, by its (type, id). Used when a
  * MIRRORLESS object is closed: it has no mirror memory, so `markGraphDirty` cannot
  * enqueue a rebuild (the queue is memory-keyed). Closing must still drop the object's
  * now-stale entity + edges from the graph, so we remove them directly here. Fail-soft
- * like `markGraphDirty` (never throws into the E2 close caller; graph staleness is
+ * like `markGraphDirty` (never throws into the object close caller; graph staleness is
  * recoverable). Deleting the entity cascade-deletes any relation where it is an endpoint
  * (relations FK entities ON DELETE CASCADE); the explicit relations DELETE also covers a
  * relation whose OWN provenance is this object (defensive — every such edge has the object

package/dist/graph-extract.d.ts

@@ -1,16 +1,15 @@
 /**
- * E3.1 deterministic entity extraction (first slice)
- * (docs/plans/2026-06-01-e3-deterministic-extraction.md).
+ * Deterministic entity extraction.
  *
- * Populates the E3 graph from the already-structured consolidated E2-object tables -
+ * Populates the graph from the already-structured consolidated first-class object tables -
  * NO NLP, no precision gate for entities + supersedes. The graph is a pure derived
- * function of the current E2 state, so `extractGraph` is an idempotent REBUILD: clear
+ * function of the current object state, so `extractGraph` is an idempotent REBUILD: clear
  * the tenant's graph, then re-derive entities + `supersedes` relations from decisions /
- * policies / customer_notes / project_briefs (the four E2 types whose kind maps to the
+ * policies / customer_notes / project_briefs (the four object types whose kind maps to the
  * `entity_type` enum). All writes go through the src/graph.ts consolidated-source guard
  * (insertEntity / insertRelation / clearGraph); this module issues no raw SQL.
  *
- * Pass 3 (E3 cross-object, docs/plans/2026-06-02-e3-cross-object-references.md) adds the
+ * Pass 3 adds the
  * first CROSS-OBJECT relations: a deterministic NAME-MATCH heuristic that emits a
  * `references` edge when one consolidated object's text contains another entity's name.
  * It is conservative (word-boundary, length-bounded, ambiguity-guarded, per-source
@@ -47,9 +46,9 @@ export interface ExtractResult {
     truncated: string[];
 }
 /**
- * Idempotent rebuild of the tenant's deterministic graph from its consolidated E2
+ * Idempotent rebuild of the tenant's deterministic graph from its consolidated first-class
  * objects. Returns the entity/relation counts (+ which types were truncated at the
- * per-type cap). Safe to re-run: output is a pure function of the current E2 state.
+ * per-type cap). Safe to re-run: output is a pure function of the current object state.
  */
 export declare function extractGraph(hippoRoot: string, tenantId: string): ExtractResult;
 //# sourceMappingURL=graph-extract.d.ts.map