v1.38.2

Fixed

• Consolidating 3+ related memories produced a different merged row for each ingest order. mergeContents picked the merge base from a sorted view (content length desc, then the shared tie order) but listed the bullets from the raw cluster, which follows created ASC, id ASC in that store. The same three memories ingested in a different order gave a different [Consolidated pattern from N related memories] row and a different rejection digest, so a rollup a human had rejected could come back under a new digest. Bullets now follow the base order and the merged row's tags are sorted, so the row is byte-identical in any ingest order. One-time effect: a 3+ rollup rejected before this release regenerates once on the next sleep and can be rejected again.

Tests

• tests/server-bearer-lockdown.test.ts now derives its route table from src/server.ts source instead of a hand-copied list, so a new /v1/* route missing buildContextWithAuth/requireAuth fails CI instead of shipping unauthed.
• Pinned two release-safety behaviours of the AML adapter (deploy/aml/adapter/adapter.mjs) the existing suite could not catch. A hippo non-200 (exercised with a real 429) now passes through with hippo's status and error body unchanged, and only the cf-connecting-ip header reaches hippo's per-client rate-limit key (x-forwarded-for and x-real-ip do not). tests/aml-adapter.test.ts gained a second real hippo plus adapter pair (HIPPO_REQUIRE_AUTH=1, HIPPO_CLIENT_IP_HEADER=cf-connecting-ip, HIPPO_V1_RPS=0.5) and two concurrency-based tests; the adapter spawn is now a shared spawnAdapter helper used by both describe blocks. No adapter behaviour change.

Changed

• The CLI now finds the nearest ancestor .hippo store, like git finds .git. getHippoRoot used to be <cwd>/.hippo strictly, so every command run from a subdirectory of an initialised project exited with "No .hippo directory found". It now reuses the bounded ancestor walk that memory scope isolation already had (resolveProjectIdentity): the walk ends at the home directory, the temp root and the filesystem root (home and the temp root are never projects, and on Windows the temp root sits inside home), and a .hippo marker must be a directory. When nothing is found the old <cwd>/.hippo is returned, so hippo init in a fresh directory behaves exactly as before, while hippo init from inside an initialised project now reports the existing store instead of creating a nested one. The "not initialised" error names the store path it settled on and the directory it searched from. Path tags are unchanged: they still derive from the working directory, not the store root.
• The MCP server shares the same bounded walk. Its own copy walked to the filesystem root with existsSync, so with cwd under home and HIPPO_HOME set elsewhere it returned ~/.hippo instead of the configured global store, and a stray file named .hippo on an ancestor was returned as a store. findHippoRoot is now exported with (cwd, opts) test seams.

Added

• Micro-eval negative-retrieval fixture (ROADMAP AT5). benchmarks/micro/fixtures/negative_retrieval.json asserts that superseded, forgotten and rejected rows do not come back from hippo recall, each against a live sibling row that shares the query's vocabulary, with an --include-superseded positive control proving the superseded row is still stored and only the default filter hides it. The runner gains a reject action (hippo reject <id> --reason) whose reattempt flag re-remembers the same text and requires the AT1 rejection guard to refuse it. No src/ change.