feat(integrations): windowed injection-cooldown parity everywhere - #63

…ow it

Closes the loop the activity feed was missing: recall serves were logged
server-side BEFORE the client's dedupe/cooldown gates ran, so the feed
over-reported what reached model context and made recall look like it
was spamming the same memories.

Server: POST /v1/activity/injected accepts a per-surface beacon
(injected ids + token/char estimates + suppressed counts by reason),
recorded as a new 'inject' activity event through the best-effort event
funnel, counted into memini_injected_memories_total{surface,result} and
memini_injected_tokens_total{surface}. The activity regrouping joins
inject reports onto nearby recall serves (same namespace, 5-minute
window — recall events carry no session id) and annotates each served
memory with injected: true/false; ABSENT means no report covered the
serve, so old data and non-reporting integrations render unchanged.

Client (Claude Code/Codex hooks): after composing stdout, each
injecting surface (briefing / prompt / pretool) sends one bounded
beacon — AbortSignal 500ms, awaited before exit, every error swallowed,
never touches stdout — gated by the new inject_telemetry setting
(MEMINI_INJECT_TELEMETRY, default on, served via the handshake like its
siblings).

UI: recall rows now read "served N → injected M" with a 'not
injected' chip on reported-suppressed memories; inject events render
their surface, per-reason suppression counts, and the token estimate.
Grafana gains an Injection efficiency row (outcomes by result, injected
by surface, injected tokens/hour).

…emory_get

Injection payloads switch from truncated-content blobs to an index the
model can expand on demand.

Server: a shared internal/api/render package projects concise content
(summary if present, else a word/sentence-boundary cut — no more
mid-sentence artifacts) behind response_format=concise on /v1/search
and format=concise on the briefing; the briefing gains
children=summary|full|none, with summary matching the isolation
contract docs always claimed (titles/counts only) while the admin UI
keeps full. Every memory now carries content_hash (16-hex sha256 of
full content||summary) in every format, and GET /v1/memories/{id} +
MCP memory_get resolve unambiguous id prefixes >= 8 hex chars (409
lists the collisions; mutations stay verbatim-id-only).

Client: hooks request concise (400-fallback for older servers), render
hits as one-liners with a trailing [m:<id8>] handle, and teach the
fetch path with a single comment line — only on blocks that actually
truncated. The briefing Recent section drops to strict index mode
(120 code points + age + handle). Dedupe identity now prefers the
server content_hash, so a memory served full in the briefing and
concise in a recall dedupes as the same memory — the regression that
made concise unsafe before.

Tail drops now say what they dropped: [+N more — memory_recall for
detail].

The inject_*_max_tok knobs stop being silent client-side trims and
become request budgets the server honors: /v1/search gains max_tokens
(fill in final rank order, first result always fits, response reports
omitted) and the briefing gains ?max_tokens (fill pinned -> facts ->
procedures -> recent, whole items only, response reports omitted).
Estimation matches the client's approxTokens recipe over the content
the response actually ships (concise text in concise mode) plus a
10-token per-item skeleton overhead.

What the budget drops is visible: recall activity events record
budget_omitted, and the hooks render the server's count in the
[+N more — memory_recall for detail] footer. Client-side fitByTokens
stays wired as the old-server fallback; a 400 on max_tokens strips it
first in the existing newest-field-first retry chain.

Defaults come off unbounded: briefing 600 tokens, recall 250, pretool
200 per file — sized so the median injection is untouched and the
multi-KB tail is what gets clipped.

… vectors

The injection-limiting primitives — suppression windows, seen-set merge,
token budgeting, render formats, identity/fingerprints, the beacon
payload — lived as hand-written .mjs in the Claude plugin and were
copy-pasted (and drifting) per integration. They now live once, as pure
functions in packages/memini-client/src/enforce/ (no fs, no env, no
clock — state and now are parameters), bundled into the plugin via the
existing _client.gen.mjs path; _shared.mjs keeps only the Node adapters
(file I/O, transport) and re-exports the same names, so hooks and their
202 tests are untouched.

packages/memini-client/vectors/enforcement.json pins 54 golden cases
generated once from the original implementations — the cross-language
contract any future port (hermes is Python) is tested against.

pi switches its local copies to the core. Two real drifts surfaced:
its injectedIdentity had fallen behind (no content_hash preference) and
its fitByTokens lacked the partial-fit trim — both adopted; pi-specific
render wordings its tests pin stay local.

The shared enforce core's semantics now hold across every integration,
not just the Claude/Codex plugin and pi:

openwebui had NO dedupe — it re-served identical memories every turn.
It gains the standard per-chat windowed cooldown (30min/3-prompt
defaults from the handshake settings), exclude_ids wire exclusion with
the old-server retry latch, and the content-identity bypass.

opencode suppressed forever within a session — the attention-decay
failure the windowed design exists to avoid. Both shipped entry points
move to windowed entries honoring inject_cooldown_ms/prompts;
re-reminding after the windows lapse is a deliberate, README-flagged
behavior change (0/0 restores forever).

openclaw's prompt-count window was inert. It now counts what that host
can honestly count — completed agent turns (agent_end) — so steps never
burn the window; a host without the signal degrades to time-only.

hermes tracked injected ids without content identity, so an updated
memory stayed withheld for the full window. It adopts the content_hash
identity + mismatch bypass, and gains a golden-vector runner replaying
packages/memini-client/vectors/enforcement.json — the cross-language
drift gate for its Python port.