hippo-memory 1.62.0 → 1.63.0

package/dist/api/recall-types.d.ts

@@ -9,10 +9,9 @@ export interface RecallOpts {
     query: string;
     limit?: number;
     /**
-     * F3 (v1.7.0): scorer-window opt-in. When set, `loadSearchEntries`
+     * Scorer-window opt-in. When set, `loadSearchEntries`
      * loads up to `scorerWindow` candidates. When undefined (default),
-     * the existing behaviour is preserved: store-internal 200-row default,
-     * which every release before v1.7.0 silently relied on.
+     * the store-internal 200-row default applies.
      *
      * `scorerWindow` lets callers decouple "how many candidates do I want
      * the scorer to evaluate" from `limit` ("how many do I want returned").
@@ -26,18 +25,16 @@ export interface RecallOpts {
      *
      * Validated as a positive finite integer when set. `scorerWindow: 0`
      * or non-finite values throw `RecallContractError` with code
-     * `invalid_scorer_window` to prevent the v1.6.x footgun where 0 fell
-     * through to an uncapped fallback (codex v1.7.0 diff-pass P1).
+     * `invalid_scorer_window`, because 0 would otherwise fall through to an
+     * uncapped fallback.
      *
-     * **Input is library-only at v1.7.0.** HTTP `/v1/memories`, MCP
+     * **Input is library-only.** HTTP `/v1/memories`, MCP
      * `hippo_recall`, and `client.ts` thin-client do NOT serialize this
      * INPUT field; remote callers cannot send `scorerWindow` and will see
      * the store default applied. The OUTPUT `RecallResult.windowSize` is
      * always serialized over the wire (HTTP `sendJson` ships the whole
      * RecallResult, so remote callers receive `windowSize: 200` in the
-     * response). Transport exposure for the input planned for v1.7.1
-     * alongside the deferred-queue items that need a wider candidate pool
-     * (e.g. mean-of-children summary re-rank).
+     * response).
      */
     scorerWindow?: number;
     /** Candidate order. `recall` always keeps the BM25 order; `retrieve` honours this. */
@@ -53,21 +50,21 @@ export interface RecallOpts {
      */
     scope?: string;
     /**
-     * v1.5.0 DAG-aware recall. When true (default), entries that overflow the
+     * DAG-aware recall. When true (default), entries that overflow the
      * `limit` and share a level-2 parent summary cause that summary to be
      * appended in their place, capped at ceil(limit * 0.3) extra rows. Set to
-     * false to disable and get the pre-v1.5 strict-limit behaviour.
+     * false for a strict limit.
      */
     summarizeOverflow?: boolean;
     /**
-     * v1.5.2 fresh-tail. When > 0, prepend the last N kind='raw' rows
+     * Fresh tail. When > 0, prepend the last N kind='raw' rows
      * (tenant + scope filtered, dedup against the BM25 hits) so an agent's
      * "what did I just see" recall path always covers the recent window
      * even when the query terms don't match. Capped at 200. Default 0 = off.
      */
     freshTailCount?: number;
     /**
-     * v1.6.2 fresh-tail session scope. When set, restricts the fresh-tail
+     * Fresh-tail session scope. When set, restricts the fresh-tail
      * window to a specific session. Without it, fresh-tail is tenant-wide,
      * which surfaces newest rows across ALL sessions — useful for "anything
      * new in this tenant", but wrong for "what did I just see in this one
@@ -79,7 +76,7 @@ export interface RecallOpts {
      * session handoff, recent session events) on the result. Default false to keep
      * the hot path cheap; agent boot paths should set this to true.
      *
-     * All three lookups are tenant-scoped to ctx.tenantId via the v0.40+ store
+     * All three lookups are tenant-scoped to ctx.tenantId via the store
      * helpers. No risk of cross-tenant leak.
      *
      * Note: when no active snapshot exists, sessionHandoff is null and
@@ -90,24 +87,23 @@ export interface RecallOpts {
      */
     includeContinuity?: boolean;
     /**
-     * v1.7.4 -- when set AND `(ctx.tenantId, sessionId)` has active goals AND
+     * When set AND `(ctx.tenantId, sessionId)` has active goals AND
      * `goalTag` is unset, `api.recall` applies the dlPFC goal-stack boost lifted
-     * from CLI cmdRecall. Pre-v1.7.4 the boost was CLI-only (env-driven via
-     * HIPPO_SESSION_ID). Undefined preserves v1.7.3 behaviour (no boost).
+     * from CLI cmdRecall. Undefined means no boost.
      *
      * Why on RecallOpts and not Context: Context is shared by remember/recall/
      * assemble/outcome. Goal-stack boost is recall-scoped only.
      */
     sessionId?: string;
     /**
-     * v1.7.4 -- explicit goal-tag override. When set, the goal-stack boost is
-     * SUPPRESSED (mirrors the CLI's `goalTag === ''` gate from v0.38). Use to
+     * Explicit goal-tag override. When set, the goal-stack boost is
+     * SUPPRESSED (mirrors the CLI's `goalTag === ''` gate). Use to
      * pin recall ranking against one specific goal/tag without the multi-goal
      * stack interfering.
      */
     goalTag?: string;
     /**
-     * v0.33 / J1 anchoring detector. Caller-supplied snapshot of the per-
+     * Anchoring detector. Caller-supplied snapshot of the per-
      * (tenant, session) recall ring. When present, api.recall computes
      * `RecallResult.anchoringHint` against this snapshot + the just-computed
      * top-1. When undefined (default), no anchoring detection runs on the
@@ -122,27 +118,25 @@ export interface RecallOpts {
      */
     recallHistory?: RecallHistorySnapshot;
     /**
-     * v1.13.x / J2 — when true, api.recall does NOT compute or emit the
+     * When true, api.recall does NOT compute or emit the
      * availabilityHint. Callers that run their OWN per-pipeline availability
      * detection over a different result set (the MCP handler computes it over
      * physics/hybrid results, not api.recall's BM25 band) pass this to avoid a
      * double audit emission and a hint describing a result set the caller never
-     * surfaces. Mirrors how J1 only computes anchoring when opts.recallHistory
+     * surfaces. Mirrors how anchoring only runs when opts.recallHistory
      * is supplied. HTTP / direct SDK callers leave this unset and receive the hint.
      */
     suppressAvailabilityHint?: boolean;
     /**
-     * A7 recall-trace. When true, api.recall captures the lifecycle re-ranking
+     * Recall trace. When true, api.recall captures the lifecycle re-ranking
      * trace (currently the goal-boost step on the primary band) and attaches it
      * to each `RecallResultItem` as `rerankTrace`, plus `rerankPipeline:'api'`.
-     * When undefined/false (default), both fields are absent on EVERY band so
-     * the response shape is byte-identical to pre-A7. The api pipeline applies
-     * only goal-boost; the richer CLI stages (interference/value/utility/
-     * reranker/retrieval-count-downweight) are A7.2.
+     * When undefined/false (default), both fields are absent on EVERY band.
+     * The api pipeline applies only goal-boost; the richer CLI stages
+     * (interference/value/utility/reranker/retrieval-count-downweight) are not traced here.
      */
     explain?: boolean;
     /**
-     * LC1 (docs/plans/2026-08-02-lc1-recall-trace-persistence.md) / F2 fix.
      * When true, api.recall does NOT write a recall_traces row for this call.
      * Mirrors `suppressAvailabilityHint`'s pattern: callers that run their OWN
      * tracing over a DIFFERENT result set must suppress api.recall's copy so
@@ -176,26 +170,24 @@ export interface RecallResultItem {
     layer: string;
     strength: number;
     /**
-     * v1.5.0 DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2).
      * True when this row is a level-2 topic summary substituted in for
      * overflowed children that didn't fit the limit.
      */
     isSummary?: boolean;
     /**
      * IDs of the overflow leaves this summary covers. Caller can drill
-     * into these via `drillDown` (Task 3) to recover the original detail.
+     * into these via `drillDown` to recover the original detail.
      */
     substitutedFor?: string[];
     /** Cached descendant count from schema v25; non-zero for level-2+ rows. */
     descendantCount?: number;
     /**
-     * v1.5.2 fresh-tail (docs/plans/2026-05-05-dag-recall.md Task 4). True
-     * for rows surfaced via the most-recent-N kind='raw' window, NOT by the
+     * True for rows surfaced via the most-recent-N kind='raw' window, NOT by the
      * BM25 query match. Caller can render them in a separate "recent" band.
      */
     isFreshTail?: boolean;
     /**
-     * A7 recall-trace. Ordered lifecycle re-ranking steps that mutated this
+     * Ordered lifecycle re-ranking steps that mutated this
      * row's `score` after candidate generation. On the api pipeline this carries
      * the goal-boost step (the only re-ranking api.recall applies). Populated
      * ONLY when `RecallOpts.explain` is set; absent on the default path
@@ -204,11 +196,11 @@ export interface RecallResultItem {
      */
     rerankTrace?: RerankStep[];
     /**
-     * A7 recall-trace. Names which pipeline produced `rerankTrace`. `'api'` on
+     * Names which pipeline produced `rerankTrace`. `'api'` on
      * every band returned by `api.recall` when `explain` is set; the CLI carries
      * its trace on `SearchResult` instead and does not set this. Absent on the
      * default path. Distinguishes the api pipeline (goal-boost only) from the
-     * richer CLI pipeline (A7.2 will unify them).
+     * richer CLI pipeline.
      */
     rerankPipeline?: 'cli' | 'api';
 }
@@ -227,20 +219,20 @@ export interface RecallResult {
      */
     continuityTokens?: number;
     /**
-     * F3 (v1.7.0): scorer window actually used for this recall. Equals
+     * Scorer window actually used for this recall. Equals
      * `opts.scorerWindow` when set, otherwise the store-internal default
      * (200) used by `loadSearchEntries(undefined, ...)`. Reported so
      * callers can introspect "did the scorer see enough candidates?"
      * without re-deriving the value.
      *
      * Optional in the type to keep `RecallResult` literal-construction
-     * back-compatible with pre-v1.7 test fakes / mocks (senior review P1-2).
+     * back-compatible with test fakes / mocks that predate the field.
      * Always present on values returned by `api.recall` itself; consumers
      * reading from `api.recall` can treat it as defined.
      */
     windowSize?: number;
     /**
-     * v1.12.13 / C5 — WYSIATI cutoff transparency. When present, gives the
+     * WYSIATI cutoff transparency. When present, gives the
      * calling agent a per-pipeline breakdown of what was excluded from
      * `results[]` and why. Always populated by `api.recall`, `cmdRecall`, and
      * the MCP `hippo_recall` handler. Optional in the type for back-compat
@@ -255,7 +247,7 @@ export interface RecallResult {
      */
     suppressionSummary?: RecallSuppressionSummary;
     /**
-     * v0.32 / J3.2 — auto-injected planning-fallacy hint. When the recall
+     * Auto-injected planning-fallacy hint. When the recall
      * query carries a forward-prediction phrase ("will take ~3 days", "ship
      * by Friday", "ETA in 2 weeks") AND the closest matching prediction
      * class has closed historical data, this carries the base-rate stats so
@@ -275,15 +267,13 @@ export interface RecallResult {
      */
     planningFallacyHint?: PlanningFallacyHint;
     /**
-     * v1.13.4 / J3.2 follow-up — "watching" variant emitted when the
+     * "Watching" variant emitted when the
      * forward-claim regex matched but no baserate could be produced
      * (either because no prediction class scored ≥ 1 on token overlap,
      * or because ≥2 classes tied at the best score). Mutually exclusive
      * with `planningFallacyHint`: at most one of the two is set per
-     * recall. Dogfood diary (docs/dogfood/2026-05-27-track-j-warnings.md)
-     * Trial 2a confirmed the pre-v1.13.4 silent-no-class-match path was
-     * the dominant J3.2 failure mode, because natural-language queries
-     * rarely share non-stopword tokens with class tags. The watching
+     * recall. Natural-language queries rarely share non-stopword tokens
+     * with class tags, so without it the hint would mostly stay silent. The watching
      * variant gives the agent enough signal to either re-tag the
      * prediction or pass the suggestion through to the user.
      *
@@ -293,9 +283,9 @@ export interface RecallResult {
      */
     planningFallacyWatching?: PlanningFallacyWatching;
     /**
-     * v0.33 / J1 (v1.13.2) — recall-recurrence anchoring hint. Populated
+     * Recall-recurrence anchoring hint. Populated
      * when api.recall's `opts.recallHistory` snapshot + the just-computed
-     * top-1 satisfy R1 (query_repeat) or R2 (memory_dominance).
+     * top-1 satisfy the query_repeat or memory_dominance rule.
      *
      * Per-pipeline detection: each pipeline (api.recall, cmdRecall, MCP)
      * computes its OWN hint against its OWN top-1. This field reflects
@@ -311,7 +301,7 @@ export interface RecallResult {
      */
     anchoringHint?: AnchoringHint;
     /**
-     * v1.13.x / J2 — availability/recency-bias hint. Per-pipeline (computed
+     * Availability/recency-bias hint. Per-pipeline (computed
      * against this pipeline's own returned top-K + the matched candidate pool
      * it was drawn from), soft-warning ONLY: never filters, reorders, or
      * suppresses a result. Fires when the returned slice is recency-dominated
@@ -321,7 +311,7 @@ export interface RecallResult {
     availabilityHint?: AvailabilityHint;
 }
 /**
- * v1.12.13 / C5 — WYSIATI cutoff transparency (Track C Pineal Gland, C5).
+ * WYSIATI cutoff transparency.
  *
  * Surfaces what the recall pipeline excluded from `results[]` so the calling
  * agent does not treat the cutoff as the full picture (Kahneman's "What You
@@ -371,19 +361,17 @@ export interface RecallSuppressionSummary {
      */
     freshTailAdded: number;
     /** Counter of memories suppressed by detected interference patterns.
-     *  v0.33 / J1 (v1.13.2): incremented by 1 PER PIPELINE when that
-     *  pipeline's own R2 memory_dominance verdict fires (via the J1
-     *  anchoring detector — see `detectAnchoring()` in src/recall-history.ts).
+     *  Incremented by 1 PER PIPELINE when that
+     *  pipeline's own memory_dominance verdict fires (via the
+     *  anchoring detector, see `detectAnchoring()` in src/recall-history.ts).
      *  Each pipeline (api.recall, cmdRecall, MCP physics/hybrid) bumps its
      *  OWN suppressionSummary independently because each runs its own
      *  detector against its own top-1 + its own per-(tenant, session) ring
      *  buffer. The number reflects this-pipeline interference only; not a
      *  cross-pipeline aggregate.
      *
-     *  Future B4-depth work may add additional sources (e.g. vlPFC inhibition
-     *  scores). No `interference_suppression` table is built — the v1.12.13
-     *  doc that referenced one was speculative; J1 uses caller-side in-memory
-     *  rings instead.
+     *  No `interference_suppression` table exists; the detector uses
+     *  caller-side in-memory rings instead.
      */
     suppressedByInterference: number;
 }

package/dist/api/recall.d.ts

@@ -5,7 +5,7 @@ import { type Context } from './types.js';
  * `api.recall`, `cmdRecall`, and the MCP `hippo_recall` handler so all three
  * pipelines produce the same shape without duplicating field-construction
  * logic. Pass-through identity today; kept as a helper so future field
- * additions (B4 interference counter wiring, etc.) land at one site.
+ * additions land at one site.
  */
 export declare function buildSuppressionSummary(counts: {
     totalCandidates: number;
@@ -20,7 +20,7 @@ export declare function buildSuppressionSummary(counts: {
  * `ctx.tenantId` and keeps that order whatever `mode` says; `retrieve` is the
  * mode-aware, strengthening variant the HTTP route uses.
  *
- * **api.recall does NOT mutate `index.last_retrieval_ids`** (v1.11.5 contract
+ * **api.recall does NOT mutate `index.last_retrieval_ids`** (contract
  * lock). The CLI `cmdRecall` (cli.ts) writes `last_retrieval_ids` because the
  * CLI is interactive (user is about to run `hippo outcome --good`). SDK callers
  * are programmatic: they either pass explicit ids to `api.outcome` or call
@@ -31,6 +31,6 @@ export declare function buildSuppressionSummary(counts: {
  * `tests/api-recall-no-side-effects.test.ts`.
  */
 export declare function recall(ctx: Context, opts: RecallOpts): RecallResult;
-/** Mode-aware recall that strengthens each returned row; never writes last_retrieval_ids (v1.11.5 lock). */
+/** Mode-aware recall that strengthens each returned row; never writes last_retrieval_ids (contract lock). */
 export declare function retrieve(ctx: Context, opts: RecallOpts): Promise<RecallResult>;
 //# sourceMappingURL=recall.d.ts.map

package/dist/api/recall.js

@@ -29,7 +29,7 @@ import { RecallContractError } from './types.js';
  * `api.recall`, `cmdRecall`, and the MCP `hippo_recall` handler so all three
  * pipelines produce the same shape without duplicating field-construction
  * logic. Pass-through identity today; kept as a helper so future field
- * additions (B4 interference counter wiring, etc.) land at one site.
+ * additions land at one site.
  */
 export function buildSuppressionSummary(counts) {
     return {
@@ -46,7 +46,7 @@ export function buildSuppressionSummary(counts) {
  * `ctx.tenantId` and keeps that order whatever `mode` says; `retrieve` is the
  * mode-aware, strengthening variant the HTTP route uses.
  *
- * **api.recall does NOT mutate `index.last_retrieval_ids`** (v1.11.5 contract
+ * **api.recall does NOT mutate `index.last_retrieval_ids`** (contract
  * lock). The CLI `cmdRecall` (cli.ts) writes `last_retrieval_ids` because the
  * CLI is interactive (user is about to run `hippo outcome --good`). SDK callers
  * are programmatic: they either pass explicit ids to `api.outcome` or call
@@ -62,7 +62,7 @@ export function recall(ctx, opts) {
     const windowSize = recallWindowSize(opts);
     return recallFrom(ctx, opts, windowSize, loadRecallSearchEntries(ctx.hippoRoot, opts.query, windowSize, ctx.tenantId, opts.scope, 'exact', false));
 }
-/** Mode-aware recall that strengthens each returned row; never writes last_retrieval_ids (v1.11.5 lock). */
+/** Mode-aware recall that strengthens each returned row; never writes last_retrieval_ids (contract lock). */
 export async function retrieve(ctx, opts) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
     const windowSize = recallWindowSize(opts);
@@ -131,11 +131,8 @@ async function retrieveFromStore(ctx, opts, windowSize, show) {
 }
 /** Contract preflight: throws before any store-touching work. */
 function recallWindowSize(opts) {
-    // F5 (v1.6.5) preflight — codex P1: original guard fired AFTER
-    // loadSearchEntries (which runs initStore, migrating legacy state on first
-    // call). For a true contract preflight we want the throw before any
-    // store-touching work. Single check here; the consumer site at
-    // `if (freshTailCount > 0)` does NOT re-validate (would be a no-op).
+    // Throw before loadSearchEntries, which runs initStore and migrates legacy state on first call.
+    // The consumer site at `if (freshTailCount > 0)` does NOT re-validate.
     const freshTailCountPreflight = opts.freshTailCount ?? 0;
     if (freshTailCountPreflight > 0 &&
         !opts.freshTailSessionId &&
@@ -143,16 +140,8 @@ function recallWindowSize(opts) {
         throw new RecallContractError('fresh_tail_requires_session_id', 'fresh-tail requires a session id when HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1; ' +
             'pass opts.freshTailSessionId or unset the env to allow tenant-wide fresh-tail.');
     }
-    // F3 (v1.7.0): scorerWindow opt-in. When undefined (default),
-    // loadSearchEntries uses its own store-internal default — this
-    // preserves every pre-v1.7.0 caller's behaviour bit-for-bit (codex
-    // mk2-pass P0-1: defaulting to `limit` would have shrunk the
-    // candidate pool and killed overflow summaries).
-    // DEFAULT_SEARCH_CANDIDATE_LIMIT is imported from store.ts so the two
-    // values cannot drift (codex diff-pass P1 #3).
-    // Validate the input — codex diff-pass P1 #1 caught that scorerWindow=0
-    // would route through FTS/LIKE LIMIT 0 and then fall through to an
-    // uncapped full-store fallback. Reject non-positive / non-finite values.
+    // Undefined keeps the store default: defaulting to `limit` would shrink the pool and kill overflow summaries.
+    // 0 would reach FTS/LIKE LIMIT 0 and then an uncapped full-store fallback, so non-positive values throw.
     if (opts.scorerWindow !== undefined) {
         if (!Number.isFinite(opts.scorerWindow) ||
             !Number.isInteger(opts.scorerWindow) ||

package/dist/api/remember.d.ts

@@ -10,14 +10,14 @@ export interface RememberOpts {
     tags?: string[];
     /**
      * Optional hook invoked inside the same transaction as the underlying
-     * memories INSERT. Used by ingestion connectors (E1.3+) to stamp
+     * memories INSERT. Used by ingestion connectors to stamp
      * idempotency / cursor rows atomically with the memory row, so a crash
      * mid-write cannot produce a memory without its corresponding side-effect
      * log row (or vice versa). If the callback throws, the INSERT is rolled
      * back and the error is rethrown.
      */
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
-    /** CD5: connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
+    /** Connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
     untrusted?: boolean;
 }
 export interface RememberResult {

package/dist/api/sleep.d.ts

@@ -64,22 +64,21 @@ export interface SleepResult {
     };
     shared?: number;
     /**
-     * v1.25.0: count of memories the auto-share secret veto withheld this sleep
+     * Count of memories the auto-share secret veto withheld this sleep
      * — rows that passed every other admission gate (transfer score,
      * not-already-global) and were blocked solely by `detectSecret`. Absent
      * when 0 or when auto-share did not run.
      */
     secretSkipped?: number;
     /**
-     * AT1: count of auto-share candidates the GLOBAL store's rejection
-     * tombstone refused this sleep (docs/plans/2026-08-15-at1-rejected-value-tombstone.md
-     * plan §3 — copy paths must not let one rejected candidate abort the
-     * batch). Absent when 0 or when auto-share did not run.
+     * Count of auto-share candidates the GLOBAL store's rejection
+     * tombstone refused this sleep; copy paths must not let one rejected
+     * candidate abort the batch. Absent when 0 or when auto-share did not run.
      */
     rejectedSkipped?: number;
     ambient?: AmbientState | null;
     /**
-     * E3 sleep enqueue-hook: graph re-extraction totals across the tenants rebuilt
+     * Graph re-extraction totals across the tenants rebuilt
      * this sleep. Absent when no tenant was dirty, and under dryRun (the graph
      * phase runs only on a real sleep). Cross-tenant aggregate, one reason
      * /v1/sleep stays loopback-only.
@@ -91,35 +90,7 @@ export interface SleepResult {
     };
     details?: string[];
 }
-/**
- * Run the pure-storage consolidation pipeline.
- *
- * Tenant scope note: sleep operates on the WHOLE hippoRoot (all tenants in
- * it), matching the pre-refactor cmdSleepCore behavior. Correct for a CLI
- * maintenance op invoked by the operator. Episode B (v1.11.4) exposed this
- * over HTTP `/v1/sleep` with loopback-only enforcement (per-request guard
- * in the handler plus serve()'s boot-time host check). The TODOS.md
- * per-tenant scoping follow-up remains open for the day non-loopback
- * serving lands — at that point the route will need an admin-role gate OR
- * api.sleep itself will need to scope dedup / audit / delete by ctx.tenantId.
- *
- * Dedup and audit deletes each log a `forget` row with the ctx actor and a
- * `metadata.reason`. Pinned, raw, kept and object-backing rows are never auto-deleted (AUTOMATIC_DELETE_SQL).
- * dryRun previews consolidate, dedup and audit, then returns before share/ambient.
- */
-/**
- * v1.12.2: Test-only DI seam shape for `sleep`'s phase dependencies.
- *
- * Each field defaults to the real production implementation imported at the
- * top of this file. Test files pass a `Partial<SleepPhases>` override via
- * `SleepOpts.__phases` (note the `__` prefix — internal-only) to inject
- * deterministic throws for mid-phase failure-path coverage (the
- * `partial: true` + `errorMessage` audit-row branch at line ~2098).
- *
- * Production callers MUST NOT use `__phases`. The field exists solely so
- * `tests/api-sleep-phase-faults.test.ts` can force each phase boundary to
- * throw without depending on store-corruption fragility.
- */
+/** Test-only seam: `SleepOpts.__phases` forces a phase to throw into emitSleepAudit's `partial: true` row; production never sets it. */
 export interface SleepPhases {
     consolidate: typeof consolidate;
     deduplicateStore: typeof deduplicateStore;
@@ -132,5 +103,6 @@ export interface SleepPhases {
     loadPendingExtractionTenants: typeof loadPendingExtractionTenants;
     extractGraph: typeof extractGraph;
 }
+/** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; never auto-deletes pinned, raw, kept or object-backing rows. */
 export declare function sleep(ctx: Context, opts?: SleepOpts): Promise<SleepResult>;
 //# sourceMappingURL=sleep.d.ts.map

package/dist/api/sleep.js

@@ -23,12 +23,13 @@ const DEFAULT_SLEEP_PHASES = {
     loadPendingExtractionTenants,
     extractGraph,
 };
+/** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; never auto-deletes pinned, raw, kept or object-backing rows. */
 export async function sleep(ctx, opts = {}) {
     const dryRun = Boolean(opts.dryRun);
-    // v1.12.2: resolve phase dependencies, allowing test-only `__phases`
+    // Resolve phase dependencies, allowing test-only `__phases`
     // override to inject deterministic throws for mid-phase failure coverage.
     const phases = { ...DEFAULT_SLEEP_PHASES, ...(opts.__phases ?? {}) };
-    // v1.11.5: phase counters for the consolidate audit emit (in finally).
+    // Phase counters for the consolidate audit emit (in finally).
     // Accumulated as each phase completes so partial-failure paths still report
     // accurate "what got done before the failure" data.
     const counts = { consolidation: 0, dedup: 0, auditDeleted: 0, ambient: 0 };

package/dist/api/tokens.d.ts

@@ -2,7 +2,7 @@ import { type TokenSummary, type TokenSurface } from '../token-ledger.js';
 import { type FailureSummary } from '../failure-log.js';
 import type { Context } from './types.js';
 /**
- * Record memory text handed to an agent in the token ledger (ROADMAP TE0).
+ * Record memory text handed to an agent in the token ledger.
  * Best-effort: never throws, because a ledger failure must not fail the
  * recall or context call that produced the text.
  */
@@ -19,7 +19,7 @@ export declare function recordTokens(ctx: Context, surface: TokenSurface, use: {
 export declare function tokenSummary(ctx: Context, opts?: {
     days?: number;
 }): TokenSummary;
-/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30); ROADMAP CD13. */
+/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30). */
 export declare function failureSummary(ctx: Context, opts?: {
     days?: number;
 }): FailureSummary;

package/dist/api/tokens.js

@@ -4,7 +4,7 @@ import { recordTokenUse, summarizeTokenUse } from '../token-ledger.js';
 import { summarizeFailures } from '../failure-log.js';
 import { log } from '../log.js';
 /**
- * Record memory text handed to an agent in the token ledger (ROADMAP TE0).
+ * Record memory text handed to an agent in the token ledger.
  * Best-effort: never throws, because a ledger failure must not fail the
  * recall or context call that produced the text.
  */
@@ -43,7 +43,7 @@ export function tokenSummary(ctx, opts = {}) {
         closeHippoDb(db);
     }
 }
-/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30); ROADMAP CD13. */
+/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30). */
 export function failureSummary(ctx, opts = {}) {
     const db = openHippoDb(ctx.hippoRoot);
     try {

package/dist/api/types.d.ts

@@ -1,18 +1,16 @@
 import { BadRequestError } from '../api-errors.js';
 /**
- * Actor identity + authorization role for a Context. v1.12.0 A5 v2 sub-1.
+ * Actor identity + authorization role for a Context.
  *
- * Before v1.12.0, Context.actor was a bare string. v1.12.0 promotes it to an
- * object carrying both the audit-log subject (formerly the string itself) and
- * a role for /v1/sleep admin gating. Audit helpers continue accepting `string`
- * — callers pass `ctx.actor.subject`. Role checks happen at the request
+ * Carries the audit-log subject plus a role for /v1/sleep admin gating. Audit
+ * helpers take the bare `string`, so callers pass `ctx.actor.subject`. Role checks happen at the request
  * boundary (e.g. /v1/sleep), except in authCreate and authRevoke (ForbiddenError).
  */
 export interface Actor {
     /** 'cli' | 'localhost:cli' | 'api_key:<key_id>' | 'mcp' | 'connector:slack' | 'connector:github' */
     subject: string;
     role: 'admin' | 'member';
-    /** EI2: restricted scopes a member key may read (auth.ts grantScope). Unused for admin actors. */
+    /** Restricted scopes a member key may read (auth.ts grantScope). Unused for admin actors. */
     scopes?: readonly string[];
     /** An auth resolver vouched for this caller, so its admin role stops at its own tenant. */
     viaAuthResolver?: true;
@@ -44,10 +42,8 @@ export declare function adminActor(subject: string): Actor;
  *     is opt-in so multi-session tenants can fail loud instead of silently
  *     surfacing cross-session rows tagged `isFreshTail=true`.
  *   - 'invalid_scorer_window' — `opts.scorerWindow` is set to a non-positive,
- *     non-integer, or non-finite value. Pre-v1.7.0 the value 0 routed
- *     through FTS/LIKE `LIMIT 0` and then fell through to an uncapped
- *     full-store fallback (codex v1.7.0 diff-pass P1). Validated upfront
- *     so the contract holds.
+ *     non-integer, or non-finite value. 0 would route through FTS/LIKE
+ *     `LIMIT 0` and then an uncapped full-store fallback, so it is validated upfront.
  */
 export declare class RecallContractError extends BadRequestError {
     readonly code: 'fresh_tail_requires_session_id' | 'invalid_scorer_window';

package/dist/api/types.js

@@ -22,10 +22,8 @@ export function adminActor(subject) {
  *     is opt-in so multi-session tenants can fail loud instead of silently
  *     surfacing cross-session rows tagged `isFreshTail=true`.
  *   - 'invalid_scorer_window' — `opts.scorerWindow` is set to a non-positive,
- *     non-integer, or non-finite value. Pre-v1.7.0 the value 0 routed
- *     through FTS/LIKE `LIMIT 0` and then fell through to an uncapped
- *     full-store fallback (codex v1.7.0 diff-pass P1). Validated upfront
- *     so the contract holds.
+ *     non-integer, or non-finite value. 0 would route through FTS/LIKE
+ *     `LIMIT 0` and then an uncapped full-store fallback, so it is validated upfront.
  */
 export class RecallContractError extends BadRequestError {
     code;

package/dist/audit-prune.d.ts

@@ -1,5 +1,5 @@
 /**
- * Audit log retention pruning (v1.12.9).
+ * Audit log retention pruning.
  *
  * The `audit_log` table grows unbounded by default — every recall, write,
  * outcome, sleep, supersede, promote, forget, archive_raw, auth_revoke,
@@ -7,10 +7,8 @@
  * accumulate to millions of rows and slow down both audit queries and
  * incremental SQLite VACUUMs.
  *
- * Closes TODOS A5 v2 M6: "Audit log unbounded growth. Add a daily `audit
- * prune` cron + `hippo audit prune --older-than 90d` CLI in v2. Mind
- * regulatory retention floors (HIPAA, SOX, GDPR) — the prune should be
- * opt-in per tenant and emit its own audit trail event."
+ * Regulatory retention floors (HIPAA, SOX, GDPR) are why the prune is opt-in
+ * per tenant and emits its own audit trail event.
  *
  * Design notes:
  *   - Per-tenant by default (matches existing audit CLI conventions).
@@ -29,7 +27,7 @@ import type { DatabaseSyncLike } from './db.js';
 export interface PruneAuditOpts {
     /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
     olderThanDays: number;
-    /** Tenant scope. Required — prune is always tenant-scoped per the A5 v2 design. */
+    /** Tenant scope. Required: prune is always tenant-scoped. */
     tenantId: string;
     /** When true, count matching rows but do NOT delete. Default false. */
     dryRun?: boolean;

package/dist/audit-prune.js

@@ -1,5 +1,5 @@
 /**
- * Audit log retention pruning (v1.12.9).
+ * Audit log retention pruning.
  *
  * The `audit_log` table grows unbounded by default — every recall, write,
  * outcome, sleep, supersede, promote, forget, archive_raw, auth_revoke,
@@ -7,10 +7,8 @@
  * accumulate to millions of rows and slow down both audit queries and
  * incremental SQLite VACUUMs.
  *
- * Closes TODOS A5 v2 M6: "Audit log unbounded growth. Add a daily `audit
- * prune` cron + `hippo audit prune --older-than 90d` CLI in v2. Mind
- * regulatory retention floors (HIPAA, SOX, GDPR) — the prune should be
- * opt-in per tenant and emit its own audit trail event."
+ * Regulatory retention floors (HIPAA, SOX, GDPR) are why the prune is opt-in
+ * per tenant and emits its own audit trail event.
  *
  * Design notes:
  *   - Per-tenant by default (matches existing audit CLI conventions).