hippo-memory 1.62.0 → 1.63.0

package/dist/physics.d.ts

@@ -52,7 +52,7 @@ export declare function computeMass(strength: number, retrievalCount: number): n
 export declare function computeCharge(valence: EmotionalValence): number;
 export declare function computeTemperature(ageDays: number, temperatureDecay: number): number;
 /**
- * F1: Query gravity (retrieval-time, virtual — does not update position).
+ * Query gravity (retrieval-time, virtual — does not update position).
  * Returns scalar force magnitude for ranking.
  *
  * F_query(i) = G_Q * mass(i) * max(0, cosine(pos_i, query))^2
@@ -64,7 +64,7 @@ export declare function queryGravityMagnitude(particle: PhysicsParticle, queryEm
  */
 export declare function velocityAlignmentBonus(particle: PhysicsParticle, queryEmbedding: number[]): number;
 /**
- * F2: Inter-memory attraction force vector (consolidation-time).
+ * Inter-memory attraction force vector (consolidation-time).
  * Attractive force from particle j on particle i.
  *
  * F_attract(i,j) = G_M * m_i * m_j * max(0, cosine(i,j))^3 * direction(j→i in embedding space)
@@ -74,7 +74,7 @@ export declare function velocityAlignmentBonus(particle: PhysicsParticle, queryE
  */
 export declare function attractionForce(pi: PhysicsParticle, pj: PhysicsParticle, G_memory: number): number[];
 /**
- * F3: Conflict repulsion force vector (consolidation-time).
+ * Conflict repulsion force vector (consolidation-time).
  * Repulsive force pushing i away from j.
  *
  * F_repel(i,j) = K_R * m_i * m_j / max(0.01, cosine_distance(i,j))^2
@@ -82,7 +82,7 @@ export declare function attractionForce(pi: PhysicsParticle, pj: PhysicsParticle
  */
 export declare function repulsionForce(pi: PhysicsParticle, pj: PhysicsParticle, K_repulsion: number): number[];
 /**
- * F4: Drag force vector (consolidation-time).
+ * Drag force vector (consolidation-time).
  * F_drag(i) = -drag * velocity(i) / max(1, effective_half_life(i))
  *
  * effectiveHalfLife should be passed in from the memory's current half_life_days.

package/dist/physics.js

@@ -79,11 +79,9 @@ const CHARGE_MAP = {
     critical: -1.0,
 };
 export function computeMass(strength, retrievalCount) {
-    // EVAL-ONLY ablation (see ablation.ts): under the recall-boost flag, particle
-    // mass must not scale with retrieval history either - query gravity ranks by
-    // mass, so prior retrieval counts would leak strengthening into the ablated
-    // arm's physics-pool rankings (codex P2). Covers both the init and refresh
-    // callers in physics-state.ts.
+    // EVAL-ONLY ablation (see ablation.ts): under the recall-boost flag mass ignores retrieval history, since
+    // query gravity ranks by mass and prior counts would leak strengthening into the ablated arm's
+    // physics-pool rankings. Covers both the init and refresh callers in physics-state.ts.
     const effectiveCount = isRecallBoostAblated() ? 0 : retrievalCount;
     return Math.max(0.01, strength * (1 + 0.1 * Math.log2(effectiveCount + 1)));
 }
@@ -97,7 +95,7 @@ export function computeTemperature(ageDays, temperatureDecay) {
 // Force computations
 // ---------------------------------------------------------------------------
 /**
- * F1: Query gravity (retrieval-time, virtual — does not update position).
+ * Query gravity (retrieval-time, virtual — does not update position).
  * Returns scalar force magnitude for ranking.
  *
  * F_query(i) = G_Q * mass(i) * max(0, cosine(pos_i, query))^2
@@ -121,7 +119,7 @@ export function velocityAlignmentBonus(particle, queryEmbedding) {
     return Math.max(0, alignment);
 }
 /**
- * F2: Inter-memory attraction force vector (consolidation-time).
+ * Inter-memory attraction force vector (consolidation-time).
  * Attractive force from particle j on particle i.
  *
  * F_attract(i,j) = G_M * m_i * m_j * max(0, cosine(i,j))^3 * direction(j→i in embedding space)
@@ -139,7 +137,7 @@ export function attractionForce(pi, pj, G_memory) {
     return vecScale(direction, magnitude);
 }
 /**
- * F3: Conflict repulsion force vector (consolidation-time).
+ * Conflict repulsion force vector (consolidation-time).
  * Repulsive force pushing i away from j.
  *
  * F_repel(i,j) = K_R * m_i * m_j / max(0.01, cosine_distance(i,j))^2
@@ -154,7 +152,7 @@ export function repulsionForce(pi, pj, K_repulsion) {
     return vecScale(direction, magnitude);
 }
 /**
- * F4: Drag force vector (consolidation-time).
+ * Drag force vector (consolidation-time).
  * F_drag(i) = -drag * velocity(i) / max(1, effective_half_life(i))
  *
  * effectiveHalfLife should be passed in from the memory's current half_life_days.

package/dist/policies.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 policy first-class object (docs/plans/2026-05-30-e2-policy-object.md).
+ * Policy first-class object.
  *
  * The "bi-temporal-first" object type: a named rule/statement that is in force
  * over an EFFECTIVE-TIME range and evolves via supersession. Two time axes:
@@ -30,8 +30,8 @@
  * loadPoliciesAsOf's asOfDate) is normalized to canonical ISO-8601 datetime
  * (`toISOString`) at the store boundary BEFORE any persist or compare, so the
  * fixed-width values sort lexically and the half-open [valid_from, valid_to)
- * comparison is correct (plan-eng-critic round-1 CRIT fix: a date-only asOf vs a
- * datetime valid_from otherwise made a same-day policy invisible).
+ * comparison is correct (a date-only asOf vs a datetime valid_from would
+ * otherwise make a same-day policy invisible).
  *
  * Dual-write atomicity: `savePolicy` writes the memory + policies row (and, on
  * supersede, the predecessor's UPDATE) inside writeEntry's SAVEPOINT.
@@ -129,21 +129,20 @@ export declare function loadActivePolicies(hippoRoot: string, tenantId: string,
  *  - `superseded` rows that cover T BUT whose successor was not yet effective at T
  *    (successor.valid_from > asOf) - i.e. an earlier version that was genuinely in
  *    force then. This is the core valid-time correctness: a Jan-Jun policy
- *    superseded in May is still the answer for `asof March`. (codex review
- *    2026-05-30, P2 #2: filtering on status='active' alone dropped historically-
- *    valid superseded versions, conflating transaction-time with valid-time. The
- *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.)
+ *    superseded in May is still the answer for `asof March`. Filtering on
+ *    status='active' alone would conflate transaction-time with valid-time; the
+ *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.
  *
  * `closed` rows are EXCLUDED: closing is a deliberate transaction-time retirement,
  * and resurrecting closed policies for a historical valid-time is full
  * transaction-time-travel (deferred). Returns an ARRAY (overlapping same-name
  * ranges are allowed in v1). Optionally filtered to one policy_name.
  *
- * Date-only `asOfDate` (e.g. "2026-05-30", no time component) resolves to the END
+ * Date-only `asOfDate` (YYYY-MM-DD, no time component) resolves to the END
  * of that UTC day (23:59:59.999Z), so "as of [day D]" includes a policy that
  * became effective at any instant during D - this is the read-side fix for the
- * common create-then-asof-today workflow, keeping the stored valid_from honest
- * (codex review 2026-05-30). A full datetime asOf is used as the precise instant.
+ * common create-then-asof-today workflow, keeping the stored valid_from honest.
+ * A full datetime asOf is used as the precise instant.
  */
 export declare function loadPoliciesAsOf(hippoRoot: string, tenantId: string, asOfDate: string, opts?: {
     name?: string;

package/dist/policies.js

@@ -1,5 +1,5 @@
 /**
- * E2 policy first-class object (docs/plans/2026-05-30-e2-policy-object.md).
+ * Policy first-class object.
  *
  * The "bi-temporal-first" object type: a named rule/statement that is in force
  * over an EFFECTIVE-TIME range and evolves via supersession. Two time axes:
@@ -30,8 +30,8 @@
  * loadPoliciesAsOf's asOfDate) is normalized to canonical ISO-8601 datetime
  * (`toISOString`) at the store boundary BEFORE any persist or compare, so the
  * fixed-width values sort lexically and the half-open [valid_from, valid_to)
- * comparison is correct (plan-eng-critic round-1 CRIT fix: a date-only asOf vs a
- * datetime valid_from otherwise made a same-day policy invisible).
+ * comparison is correct (a date-only asOf vs a datetime valid_from would
+ * otherwise make a same-day policy invisible).
  *
  * Dual-write atomicity: `savePolicy` writes the memory + policies row (and, on
  * supersede, the predecessor's UPDATE) inside writeEntry's SAVEPOINT.
@@ -114,7 +114,7 @@ function buildPolicyContent(policyName, policyText, validFrom, validTo) {
 // Preflight the supersede target BEFORE inserting the new row (so the new
 // autoincrement id can never be its own supersede target); read the
 // predecessor version in the same SELECT for server-derived versioning.
-// Mirrors saveProcess / saveDecision (codex P1 2026-05-28).
+// Mirrors saveProcess / saveDecision.
 function preflightPolicySupersede(db, tenantId, supersedesId) {
     // SAFETY: SELECT projects exactly status, version; .get() returns that
     // shape for the matching row, or undefined when no policy/tenant pair matches.
@@ -206,8 +206,7 @@ export function savePolicy(hippoRoot, tenantId, opts, actor = 'cli') {
     // (a date-only asOf resolves to end-of-day in loadPoliciesAsOf), NOT by
     // backdating the stored valid_from - backdating to midnight would make an
     // earlier-same-day as-of wrongly report the policy already in force and would
-    // hide a superseded predecessor for that earlier time (codex review
-    // 2026-05-30 round 2). An explicit --from is honored as-is.
+    // hide a superseded predecessor for that earlier time. An explicit --from is honored as-is.
     const { validFrom, validTo } = validatePolicyDates(opts.validFrom, opts.validTo, now);
     const isSupersede = opts.supersedesPolicyId !== undefined;
     const changeSummary = isSupersede ? (opts.changeSummary ?? null) : null;
@@ -290,7 +289,7 @@ export function closePolicy(hippoRoot, tenantId, id, actor = 'cli') {
             // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
             // not only via an enqueued rebuild whose queue item is lost if the mirror is later
             // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget (codex P1). Still enqueue when a mirror exists
+            // object stale and could block that forget. Still enqueue when a mirror exists
             // so a concurrent rebuild re-derives consistently (harmless if it also runs).
             removeGraphEntitiesForObject(hippoRoot, tenantId, 'policy', closed.id);
             if (closed.memoryId) {
@@ -376,21 +375,20 @@ export function loadActivePolicies(hippoRoot, tenantId, opts = {}) {
  *  - `superseded` rows that cover T BUT whose successor was not yet effective at T
  *    (successor.valid_from > asOf) - i.e. an earlier version that was genuinely in
  *    force then. This is the core valid-time correctness: a Jan-Jun policy
- *    superseded in May is still the answer for `asof March`. (codex review
- *    2026-05-30, P2 #2: filtering on status='active' alone dropped historically-
- *    valid superseded versions, conflating transaction-time with valid-time. The
- *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.)
+ *    superseded in May is still the answer for `asof March`. Filtering on
+ *    status='active' alone would conflate transaction-time with valid-time; the
+ *    successor-aware filter mirrors the existing recall-history.ts asOf pattern.
  *
  * `closed` rows are EXCLUDED: closing is a deliberate transaction-time retirement,
  * and resurrecting closed policies for a historical valid-time is full
  * transaction-time-travel (deferred). Returns an ARRAY (overlapping same-name
  * ranges are allowed in v1). Optionally filtered to one policy_name.
  *
- * Date-only `asOfDate` (e.g. "2026-05-30", no time component) resolves to the END
+ * Date-only `asOfDate` (YYYY-MM-DD, no time component) resolves to the END
  * of that UTC day (23:59:59.999Z), so "as of [day D]" includes a policy that
  * became effective at any instant during D - this is the read-side fix for the
- * common create-then-asof-today workflow, keeping the stored valid_from honest
- * (codex review 2026-05-30). A full datetime asOf is used as the precise instant.
+ * common create-then-asof-today workflow, keeping the stored valid_from honest.
+ * A full datetime asOf is used as the precise instant.
  */
 export function loadPoliciesAsOf(hippoRoot, tenantId, asOfDate, opts = {}) {
     assertTenantId('loadPoliciesAsOf', tenantId);

package/dist/postinstall.js

@@ -7,12 +7,9 @@ function main() {
     if (envSkipPostinstall())
         return;
     try {
-        // Repair-only: re-ensure the wrapper for users who previously opted in
-        // (e.g. a Codex update restored the real binary over our shim). A first
-        // install never happens here — swapping the codex binary from a package
-        // postinstall is a consent violation and reads as binary hijacking to
-        // supply-chain scanners (issue #133). First install is `hippo hook
-        // install codex` only.
+        // Repair-only, for users who opted in (a Codex update can restore the real binary over our shim).
+        // Swapping the binary from postinstall is a consent violation that supply-chain scanners read as
+        // hijacking, so first install is `hippo hook install codex` only.
         repairCodexWrapperIfInstalled();
     }
     catch {

package/dist/predictions/planning-fallacy.d.ts

@@ -1,13 +1,11 @@
 /**
- * J3.2 surface delivered on `RecallResult.planningFallacyHint` when an
+ * Surface delivered on `RecallResult.planningFallacyHint` when an
  * agent's recall query carries a forward-prediction phrase AND the closest
  * matching prediction class has closed historical data.
  *
  * The agent sees its track record at the moment of forecasting, anchoring
  * on the outside view (Lovallo-Kahneman 2003) rather than the inside-view
  * inside the planning fallacy.
- *
- * Plan: docs/plans/2026-05-26-j32-auto-injection.md.
  */
 export interface PlanningFallacyHint {
     classTag: string;
@@ -25,13 +23,11 @@ export interface PlanningFallacyHint {
     meanRatio: number | null;
 }
 /**
- * v1.13.4 / J3.2 follow-up — "watching" variant emitted when the
- * forward-claim regex matched but no PlanningFallacyHint baserate was
- * returned. Dogfood diary (docs/dogfood/2026-05-27-track-j-warnings.md)
- * Trial 2a confirmed the pre-v1.13.4 silent paths were the most common
- * real-world J3.2 failure mode: a natural-language query carries a
+ * "Watching" variant emitted when the forward-claim regex matched but no
+ * PlanningFallacyHint baserate was returned. Silence was the most common
+ * real-world failure: a natural-language query carries a
  * forward-claim phrase but its non-stopword tokens don't overlap with
- * any prediction class tag, so hippo silently emitted nothing despite
+ * any prediction class tag, so hippo emitted nothing despite
  * the regex match. The watching variant surfaces the detection event
  * + a one-line suggestion so the agent can either re-tag the prediction
  * or pass the suggestion through to the user.
@@ -48,7 +44,7 @@ export interface PlanningFallacyWatching {
     suggestion: string;
 }
 /**
- * v1.13.4 / J3.2 follow-up — richer return type for
+ * Richer return type for
  * `computePlanningFallacyOutput`. Carries EITHER `hint` (baserate
  * available) OR `watching` (regex fired, no baserate), or NEITHER (mode=off,
  * no queryText, no regex match, or nClosed=0 silent path). Never both.
@@ -71,7 +67,7 @@ export interface ComputePlanningFallacyHintOpts {
     actor?: string;
 }
 /**
- * J3.2 orchestrator.
+ * Planning-fallacy orchestrator.
  *
  * Composes the forward-claim detector + class resolver + baserate compute,
  * with telemetry-grade audit emission at every decision point (success,
@@ -83,7 +79,7 @@ export interface ComputePlanningFallacyHintOpts {
  *   - no forward-claim regex match
  *   - resolved class has nClosed=0 (no historical data yet; silent)
  *
- * Returns `{ watching: ... }` on (v1.13.4 NEW — was silent null pre-1.13.4):
+ * Returns `{ watching: ... }` on:
  *   - resolver returns no class (no overlap ≥ 1; emits no_class_match audit)
  *   - resolver returns tiebreak (≥2 classes tied at best; emits tiebreak audit)
  *
@@ -93,8 +89,7 @@ export interface ComputePlanningFallacyHintOpts {
  * audit carries n_closed + mean_ratio in metadata so no telemetry is lost),
  * then emits recall_autodebias_hint audit + returns the hint.
  *
- * Latency budget (plan §Latency): ~50us regex-only on miss; ~750-850us
- * on full match+resolve+baserate path. Well under 50ms target.
+ * Latency budget: well under 50ms; a miss pays only the regex.
  */
 export declare function computePlanningFallacyOutput(hippoRoot: string, tenantId: string, queryText: string, opts?: ComputePlanningFallacyHintOpts): PlanningFallacyOutput;
 //# sourceMappingURL=planning-fallacy.d.ts.map

package/dist/predictions/planning-fallacy.js

@@ -11,8 +11,8 @@ import { computePredictionBaserate } from './store.js';
  * Indexed via idx_predictions_tenant_class (db.ts:1015) → O(log n) seek
  * plus a small DISTINCT scan over the per-tenant class-tag set.
  *
- * Scope behaviour (v1 design choice, independent-review-critic round 1
- * MED): class_tag selection is TENANT-GLOBAL, NOT scope-filtered against
+ * Scope behaviour (deliberate): class_tag selection is TENANT-GLOBAL,
+ * NOT scope-filtered against
  * the recall's opts.scope. The class_tag is an aggregator label across
  * historical predictions in the class, not a per-memory scope-bound
  * property. A no-scope recall CAN surface a class_tag from a privately-
@@ -75,7 +75,7 @@ function resolveClassFromTokens(hippoRoot, tenantId, queryTokens) {
     }
 }
 /**
- * J3.2 orchestrator.
+ * Planning-fallacy orchestrator.
  *
  * Composes the forward-claim detector + class resolver + baserate compute,
  * with telemetry-grade audit emission at every decision point (success,
@@ -87,7 +87,7 @@ function resolveClassFromTokens(hippoRoot, tenantId, queryTokens) {
  *   - no forward-claim regex match
  *   - resolved class has nClosed=0 (no historical data yet; silent)
  *
- * Returns `{ watching: ... }` on (v1.13.4 NEW — was silent null pre-1.13.4):
+ * Returns `{ watching: ... }` on:
  *   - resolver returns no class (no overlap ≥ 1; emits no_class_match audit)
  *   - resolver returns tiebreak (≥2 classes tied at best; emits tiebreak audit)
  *
@@ -97,8 +97,7 @@ function resolveClassFromTokens(hippoRoot, tenantId, queryTokens) {
  * audit carries n_closed + mean_ratio in metadata so no telemetry is lost),
  * then emits recall_autodebias_hint audit + returns the hint.
  *
- * Latency budget (plan §Latency): ~50us regex-only on miss; ~750-850us
- * on full match+resolve+baserate path. Well under 50ms target.
+ * Latency budget: well under 50ms; a miss pays only the regex.
  */
 export function computePlanningFallacyOutput(hippoRoot, tenantId, queryText, opts = {}) {
     // Env read FIRST so AUTODEBIAS=off pays zero regex cost. Per-call read
@@ -115,19 +114,14 @@ export function computePlanningFallacyOutput(hippoRoot, tenantId, queryText, opt
     const actor = opts.actor ?? 'recall';
     const resolution = resolveClassFromTokens(hippoRoot, tenantId, match.classQueryTokens);
     if (resolution.tiebreak) {
-        // Telemetry: forward-claim detected, ≥2 classes tied at best overlap.
-        // v1.13.4: now ALSO returns a watching variant so the caller surface
-        // can render a "watching but no baserate (tiebreak)" line. Audit emission
-        // unchanged (the audit channel is the telemetry-grade source of truth).
+        // Telemetry: forward-claim detected, ≥2 classes tied at best overlap. The watching variant lets the
+        // caller render "watching but no baserate (tiebreak)"; the audit channel stays the source of truth.
         return watchingWithAudit(hippoRoot, tenantId, actor, match, 'tiebreak', TIEBREAK_SUGGESTION);
     }
     if (!resolution.classTag) {
-        // Telemetry: forward-claim detected, no class scored ≥ 1.
-        // This is the channel that drives the embedding-fallback decision
-        // for J3.3 — high volume here = regex+token-overlap is missing
-        // legitimate forward-claims that have NO obvious class signal.
-        // v1.13.4: now ALSO returns a watching variant so the caller surface
-        // can render a "watching but no baserate (no class match)" line.
+        // Telemetry: forward-claim detected, no class scored ≥ 1. High volume here means regex+token-overlap
+        // misses real forward-claims with no class signal, the case for an embedding fallback.
+        // The watching variant lets the caller render "watching but no baserate (no class match)".
         return watchingWithAudit(hippoRoot, tenantId, actor, match, 'no_class_match', NO_CLASS_MATCH_SUGGESTION);
     }
     // emitAudit=false: avoid double-write to predict_baserate channel.

package/dist/predictions/store.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 prediction first-class object (v0.31 / docs/plans/2026-05-26-e2-prediction-object.md).
+ * Prediction first-class object.
  *
  * Canonical store for ex-ante claims that can be closed against ex-post
  * outcomes. The `predictions` table holds every field (including
@@ -19,10 +19,8 @@
  * a failure in either step rolls back both. Pattern matches supersede
  * (api.ts:1486) and the Slack/GitHub connectors.
  *
- * J3 (reference-class / planning-fallacy detector) reads from
- * `loadPredictionsByClass` to compute per-class base rates from
- * (estimate_value, actual_value) at query time. J3 is a follow-up episode;
- * this module ships the data layer.
+ * The planning-fallacy detector reads `loadPredictionsByClass` and computes
+ * per-class base rates from (estimate_value, actual_value) at query time.
  */
 import { type KeysetPosition } from '../keyset.js';
 export type ClosureState = 'open' | 'closed' | 'closed-unknown';
@@ -71,18 +69,22 @@ export interface ListPredictionsOpts {
  * The memory is tagged `['prediction', classTag]` with `source='prediction'`
  * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
  * see open predictions naturally; the predictions table is the canonical
- * structured store used by J3.
+ * structured store used by the planning-fallacy detector.
  */
 export declare function savePrediction(hippoRoot: string, tenantId: string, opts: SavePredictionOpts, actor?: string): Prediction;
 /**
  * Close an existing open prediction. Updates the predictions row only;
  * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * J3 computes accuracy (clean vs regressed) from (estimateValue,
- * actualValue) at query time.
+ * Accuracy is computed from (estimateValue, actualValue) at query time.
  */
 export declare function closePrediction(hippoRoot: string, tenantId: string, id: number, opts: ClosePredictionOpts, actor?: string): Prediction;
 export declare function loadPredictionById(hippoRoot: string, tenantId: string, id: number): Prediction | null;
 export declare function loadPredictionsByClass(hippoRoot: string, tenantId: string, classTag: string, opts?: ListPredictionsOpts): Prediction[];
+/** Every prediction in the tenant, open and closed, across all classes: the `status=all` list without a class. */
+export declare function loadAllPredictions(hippoRoot: string, tenantId: string, opts?: {
+    limit?: number;
+    after?: KeysetPosition;
+}): Prediction[];
 export interface PredictionBaserate {
     classTag: string;
     /** Count of closed predictions with a numeric actual_value (excludes
@@ -105,28 +107,18 @@ export interface PredictionBaserate {
     summary: string;
 }
 /**
- * Compute base-rate stats for closed predictions in a class. Used by J3
- * reference-class / planning-fallacy detector. Direct application of
- * Lovallo-Kahneman (2003) inside-vs-outside view.
+ * Compute base-rate stats for closed predictions in a class for the
+ * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
  *
  * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
  * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
  * compare against) and open (not yet resolved).
  *
- * Audit-emit is BUILT IN here (single source of truth, no caller-site
- * drift risk). Plan-eng-critic round 1 HIGH recommendation: emit inside
- * helper, not at 3 call sites.
+ * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
  */
 export declare function computePredictionBaserate(hippoRoot: string, tenantId: string, classTag: string, actor?: string, 
-/** v0.32 / J3.2 — when false, skip the predict_baserate audit emit. The
- *  J3.2 orchestrator (computePlanningFallacyOutput, below) calls this with
- *  emitAudit=false and emits its own `recall_autodebias_hint` audit row
- *  instead, so the predict_baserate channel stays scoped to deliberate
- *  CLI / HTTP / MCP predict-baserate calls and does NOT pollute on every
- *  recall containing a forward-claim phrase. Default true preserves the
- *  v1.13.0 J3 audit semantics for the 3 direct callers (cmdPredict
- *  baserate, /v1/predictions/stats route, hippo_predict_baserate MCP
- *  handler) — none of them pass this argument. */
+/** False skips the predict_baserate audit so that channel only records deliberate
+ *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
 emitAudit?: boolean): PredictionBaserate;
 export declare function loadOpenPredictions(hippoRoot: string, tenantId: string, opts?: {
     classTag?: string;

package/dist/predictions/store.js

@@ -1,5 +1,5 @@
 /**
- * E2 prediction first-class object (v0.31 / docs/plans/2026-05-26-e2-prediction-object.md).
+ * Prediction first-class object.
  *
  * Canonical store for ex-ante claims that can be closed against ex-post
  * outcomes. The `predictions` table holds every field (including
@@ -19,10 +19,8 @@
  * a failure in either step rolls back both. Pattern matches supersede
  * (api.ts:1486) and the Slack/GitHub connectors.
  *
- * J3 (reference-class / planning-fallacy detector) reads from
- * `loadPredictionsByClass` to compute per-class base rates from
- * (estimate_value, actual_value) at query time. J3 is a follow-up episode;
- * this module ships the data layer.
+ * The planning-fallacy detector reads `loadPredictionsByClass` and computes
+ * per-class base rates from (estimate_value, actual_value) at query time.
  */
 import { BadRequestError, NotFoundError } from '../api-errors.js';
 import { openHippoDb, closeHippoDb } from '../db.js';
@@ -68,7 +66,7 @@ function rowToPrediction(row) {
  * The memory is tagged `['prediction', classTag]` with `source='prediction'`
  * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
  * see open predictions naturally; the predictions table is the canonical
- * structured store used by J3.
+ * structured store used by the planning-fallacy detector.
  */
 export function savePrediction(hippoRoot, tenantId, opts, actor = 'cli') {
     assertTenantId('savePrediction', tenantId);
@@ -142,8 +140,7 @@ function insertPredictionRow(db, memoryId, tenantId, opts, now, actor) {
 /**
  * Close an existing open prediction. Updates the predictions row only;
  * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * J3 computes accuracy (clean vs regressed) from (estimateValue,
- * actualValue) at query time.
+ * Accuracy is computed from (estimateValue, actualValue) at query time.
  */
 export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
     assertTenantId('closePrediction', tenantId);
@@ -175,13 +172,8 @@ export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
 }
 /** Closes the row, reloads it and audits the close; the caller owns the transaction. */
 function closeOpenPredictionRow(db, tenantId, id, opts, now, actor) {
-    // Codex review finding 2026-05-26: WHERE clause requires
-    // closure_state='open' so duplicate close requests / retries against
-    // an already-closed prediction return a clear error instead of
-    // silently overwriting actual_value + emitting a duplicate
-    // predict_close audit row. Zero changed rows → caller decides
-    // whether it's a "not found" or "already closed" case based on the
-    // load-then-close pattern.
+    // closure_state='open' in the WHERE stops a retried close from overwriting
+    // actual_value and auditing twice; zero changed rows means not found or already closed.
     const updateResult = db.prepare(`
         UPDATE predictions
         SET actual_value = ?, closure_state = ?, closed_at = ?, closure_note = ?
@@ -283,29 +275,41 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
         closeHippoDb(db);
     }
 }
+/** Every prediction in the tenant, open and closed, across all classes: the `status=all` list without a class. */
+export function loadAllPredictions(hippoRoot, tenantId, opts = {}) {
+    assertTenantId('loadAllPredictions', tenantId);
+    const after = keysetAfter('created_at', 'id', opts.after);
+    const db = openHippoDb(hippoRoot);
+    try {
+        // SAFETY: rows' shape matches the columns named in the SELECT.
+        const rows = db.prepare(`
+      SELECT id, memory_id, tenant_id, class_tag, claim_text,
+             estimate_value, estimate_unit, target_date,
+             actual_value, closure_state, closed_at, closure_note, created_at
+      FROM predictions
+      WHERE tenant_id = ?${after.sql}
+      ORDER BY created_at DESC, id DESC
+      LIMIT ?
+    `).all(tenantId, ...after.params, opts.limit ?? 100);
+        return rows.map(rowToPrediction);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 /**
- * Compute base-rate stats for closed predictions in a class. Used by J3
- * reference-class / planning-fallacy detector. Direct application of
- * Lovallo-Kahneman (2003) inside-vs-outside view.
+ * Compute base-rate stats for closed predictions in a class for the
+ * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
  *
  * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
  * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
  * compare against) and open (not yet resolved).
  *
- * Audit-emit is BUILT IN here (single source of truth, no caller-site
- * drift risk). Plan-eng-critic round 1 HIGH recommendation: emit inside
- * helper, not at 3 call sites.
+ * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
  */
 export function computePredictionBaserate(hippoRoot, tenantId, classTag, actor = 'cli', 
-/** v0.32 / J3.2 — when false, skip the predict_baserate audit emit. The
- *  J3.2 orchestrator (computePlanningFallacyOutput, below) calls this with
- *  emitAudit=false and emits its own `recall_autodebias_hint` audit row
- *  instead, so the predict_baserate channel stays scoped to deliberate
- *  CLI / HTTP / MCP predict-baserate calls and does NOT pollute on every
- *  recall containing a forward-claim phrase. Default true preserves the
- *  v1.13.0 J3 audit semantics for the 3 direct callers (cmdPredict
- *  baserate, /v1/predictions/stats route, hippo_predict_baserate MCP
- *  handler) — none of them pass this argument. */
+/** False skips the predict_baserate audit so that channel only records deliberate
+ *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
 emitAudit = true) {
     assertTenantId('computePredictionBaserate', tenantId);
     if (!classTag)
@@ -325,9 +329,8 @@ emitAudit = true) {
         const nClosed = rows.length;
         if (nClosed === 0) {
             // Audit zero-result reads too — agents probing empty classes is
-            // a signal worth recording. Skipped when emitAudit=false (J3.2
-            // orchestrator path; its own recall_autodebias_hint audit fires
-            // only when nClosed > 0 anyway, so no signal is lost).
+            // a signal worth recording. Skipped when emitAudit=false: the orchestrator's own
+            // recall_autodebias_hint audit fires only when nClosed > 0, so no signal is lost.
             if (emitAudit)
                 auditBaserateRead(db, tenantId, actor, classTag, 0);
             return {

package/dist/processes.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 process first-class object (docs/plans/2026-05-29-e2-process-object.md).
+ * Process first-class object.
  *
  * A `process` is a "living process map": a named, ordered list of steps that
  * evolves over time. Unlike `incident` (open->resolved->closed, no supersede),
@@ -31,13 +31,9 @@
  * them back. Pattern matches saveDecision (decisions.ts).
  */
 import { type KeysetPosition } from './keyset.js';
+import type { JsonValue } from './json.js';
 export type ProcessStatus = 'active' | 'superseded' | 'closed';
 export declare const VALID_PROCESS_STATES: ReadonlySet<ProcessStatus>;
-/** Arbitrary JSON-shaped value; the domain type for untrusted input at the
- *  steps I/O boundary (validateProcessSteps parses this into string[]). */
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
 /** DoS / abuse caps on the steps body (untrusted at the HTTP/SDK boundary). */
 export declare const MAX_PROCESS_STEPS = 200;
 export declare const MAX_PROCESS_STEP_LEN = 2000;
@@ -109,5 +105,4 @@ export declare function loadProcesses(hippoRoot: string, tenantId: string, opts?
 export declare function loadActiveProcesses(hippoRoot: string, tenantId: string, opts?: {
     limit?: number;
 }): Process[];
-export {};
 //# sourceMappingURL=processes.d.ts.map

package/dist/processes.js

@@ -1,5 +1,5 @@
 /**
- * E2 process first-class object (docs/plans/2026-05-29-e2-process-object.md).
+ * Process first-class object.
  *
  * A `process` is a "living process map": a named, ordered list of steps that
  * evolves over time. Unlike `incident` (open->resolved->closed, no supersede),
@@ -134,8 +134,8 @@ function buildProcessContent(processName, steps, description) {
 // row's autoincrement id could otherwise collide with a non-existent
 // supersedesProcessId (e.g. superseding id 1 on an empty store), making
 // the row supersede itself. Validating first means the new row is never a
-// candidate for its own supersede UPDATE. Mirrors saveDecision (codex P1
-// 2026-05-28). The same SELECT reads the predecessor version so the
+// candidate for its own supersede UPDATE. Mirrors saveDecision.
+// The same SELECT reads the predecessor version so the
 // successor's version is server-derived, never client-supplied.
 function preflightProcessSupersede(db, tenantId, supersedesId) {
     // SAFETY: SELECT status, version FROM processes; row shape matches

package/dist/project-briefs.d.ts

@@ -1,6 +1,5 @@
 /**
- * E2 project_brief first-class object
- * (docs/plans/2026-05-30-e2-project-brief-object.md).
+ * Project_brief first-class object.
  *
  * A `project_brief` is the living, repo-scoped summary of a repository's state: a
  * `summary` body scoped to a `repo`, evolving via the supersede delta lifecycle.
@@ -94,7 +93,7 @@ export declare function loadProjectBriefs(hippoRoot: string, tenantId: string, o
 /**
  * The repo's CURRENT active brief, or null. By convention there is one active brief
  * per (tenant, repo); if an operator created more than one (the DB does not prevent
- * it, consistent with every other E2 object), the MOST-RECENT active row wins.
+ * it, consistent with every other first-class object), the MOST-RECENT active row wins.
  */
 export declare function loadActiveBriefForRepo(hippoRoot: string, tenantId: string, repo: string): ProjectBrief | null;
 /**