hippo-memory 1.57.0 → 1.59.0

package/dist/cli.js

@@ -20,6 +20,7 @@
  *   hippo rejections
  *   hippo unreject <digest-prefix>
  *   hippo dormant [<query>] [--limit <n>] [--json] | restore <id> | forget <id>
+ *   hippo projects [--json] | merge <from> <into> [--apply] | repair [--apply]
  *   hippo tokens [--days <n>] [--json] [--global]
  *   hippo doctor [--json]
  *   hippo inspect <id>
@@ -59,7 +60,8 @@ import { resolveEmbeddingProvider } from './embedding-provider.js';
 import { loadPhysicsState, resetAllPhysicsState } from './physics-state.js';
 import { computeSystemEnergy, vecNorm } from './physics.js';
 import { loadConfig } from './config.js';
-import { openHippoDb, closeHippoDb } from './db.js';
+import { ensurePilotArm, hashArm, readPilotArm } from './pilot-arm.js';
+import { openHippoDb, closeHippoDb, withSharedStoreHandles, HOOK_DB_WAIT_MS, isSqliteBusy, noteStoreBusy } from './db.js';
 import { runDoctor, formatDoctor } from './doctor.js';
 import { buildSupportBundle, TAIL_MAX_LINES } from './support-bundle.js';
 import { PACKAGE_VERSION } from './version.js';
@@ -88,6 +90,7 @@ import { listApiKeys } from './auth.js';
 import { buildProvenanceCoverage } from './provenance-coverage.js';
 import { buildCorrectionLatency } from './correction-latency.js';
 import * as api from './api.js';
+import { vetSecrets } from './secret-detect.js';
 import * as predictionsModule from './predictions.js';
 import { computePlanningFallacyOutput } from './predictions.js';
 import * as decisionsModule from './decisions.js';
@@ -133,6 +136,7 @@ import { MAX_HOPS, DEFAULT_MAX_NEIGHBORS } from './graph-recall.js';
 import { getReranker } from './rerankers/index.js';
 import { rankRecall } from './recall-pipeline.js';
 import { JEV_DEFAULT_TOP_K } from './rerankers/jev.js';
+import { isClefModel } from './rerankers/clef.js';
 import { computeSalience } from './salience.js';
 import { renderAmbientSummary } from './ambient.js';
 import { assembleCost, assembleHeading, contextCost, contextHeading, contextLine, crossProjectHeading, crossProjectLine, drillCost, handoffText, printedTokens, sessionTrailText, settleTokens, snapshotText, } from './context-render.js';
@@ -143,6 +147,8 @@ import { backfillChannel } from './connectors/slack/backfill.js';
 import { slackHistoryFetcher } from './connectors/slack/web-client.js';
 import { addWorkspace as addSlackWorkspace, listWorkspaces as listSlackWorkspaces, removeWorkspace as removeSlackWorkspace, } from './connectors/slack/workspaces.js';
 import { cmdGithub, printGithubBackfillUsage } from './connectors/github/cli-impl.js';
+import { log } from './log.js';
+import { printError } from './cli/output.js';
 import { parseLimitFlag, parseCountFlag, parseBudgetFlag, emitCliAudit, requireInit, runChurnStaleForRepo, runViaServerIfAvailable, fmt, recallEntryText, recallHeading, printAgentImport, hippoBlock, installCodexMemoryHooks, setupDailySchedule, parseAsOfFlag, engineFlags, collectHandoffEvidence, logSessionEndImport, appendSessionEndCloseLog, printActiveTaskSnapshot, printSessionEvents, printHandoff, cardStringFlag, hostSessionId, resetHookInjection, captureConsole, hookStoreRoot, withLedgerDb, learnFromRepo, HOOK_MARKERS, HOOKS, resolveAuthRoot, } from './cli/shared.js';
 // ---------------------------------------------------------------------------
 // Helpers
@@ -151,7 +157,7 @@ import { parseLimitFlag, parseCountFlag, parseBudgetFlag, emitCliAudit, requireI
 // and as off under === true (`--pin=true` would not pin), so parseArgs and main() refuse one.
 // tests/cli-parse-flag-equals.test.ts fails when a switch read is missing from this set.
 export const BOOLEAN_FLAGS = new Set([
-    'agents', 'all', 'all-tenants', 'archive', 'auto', 'bad', 'bootstrap', 'classic', 'churn', 'continuity',
+    'agents', 'all', 'all-tenants', 'apply', 'archive', 'auto', 'bad', 'bootstrap', 'classic', 'churn', 'continuity',
     'cross-project', 'dry-run', 'equal-sources', 'error', 'evc-adaptive', 'extract',
     'filter-conflicts', 'fix', 'force', 'forget', 'git', 'global', 'good', 'graph-stream',
     'help', 'include-logs', 'include-superseded', 'inferred', 'json', 'last-session', 'multihop', 'no-hooks',
@@ -179,7 +185,7 @@ export const KNOWN_FLAGS = new Set([
 ]);
 // Commands that delete or hide memories: an unknown flag here stops the run instead of being ignored.
 const DESTRUCTIVE_COMMANDS = new Set([
-    'audit', 'dedup', 'forget', 'invalidate', 'reject', 'resolve', 'sleep', 'supersede',
+    'audit', 'dedup', 'forget', 'invalidate', 'projects', 'reject', 'resolve', 'sleep', 'supersede',
 ]);
 // Commands that honour --dry-run. Any other command would ignore it and run for real.
 const DRY_RUN_COMMANDS = new Set([
@@ -635,18 +641,18 @@ async function cmdRemember(hippoRoot, text, flags) {
     // 'archived' is an internal sentinel set only inside archiveRawMemory's transaction.
     const userVisibleKinds = ['distilled', 'superseded'];
     if (kindFlag !== undefined && !userVisibleKinds.includes(kindFlag)) {
-        console.error(`Invalid --kind: "${kindFlagRaw}". Must be one of: ${userVisibleKinds.join(', ')}`);
-        console.error(`(kind='raw' is reserved for ingestion connectors; kind='archived' is internal.)`);
+        printError(`Invalid --kind: "${kindFlagRaw}". Must be one of: ${userVisibleKinds.join(', ')}`);
+        printError(`(kind='raw' is reserved for ingestion connectors; kind='archived' is internal.)`);
         process.exit(1);
     }
     const ownerRaw = typeof flags['owner'] === 'string' ? flags['owner'] : null;
     const ownerCheck = validateOwner(ownerRaw, { strict: isStrictOwnerEnv() });
     if (!ownerCheck.ok) {
-        console.error(ownerCheck.message);
+        printError(ownerCheck.message);
         process.exit(1);
     }
     if (ownerCheck.message)
-        console.error(ownerCheck.message);
+        printError(ownerCheck.message);
     const ownerFlag = ownerCheck.value ?? null;
     const artifactRefFlag = typeof flags['artifact-ref'] === 'string' ? flags['artifact-ref'] : null;
     const scopeForEnvelope = typeof flags['scope'] === 'string' ? flags['scope'].trim() || null : null;
@@ -695,6 +701,8 @@ async function cmdRemember(hippoRoot, text, flags) {
         console.log(`   Tags: ${entry.tags.join(', ')}`);
     if (entry.pinned)
         console.log('   Pinned (no decay)');
+    for (const w of vetSecrets(entry.content, entry.tags, false).warnings)
+        printError(`Warning: ${w}`);
     void embedMemory(targetRoot, entry);
     const config = loadConfig(targetRoot);
     const shouldExtract = flags['extract'] || config.extraction.enabled === true;
@@ -705,31 +713,31 @@ async function cmdRemember(hippoRoot, text, flags) {
             const facts = await extractFacts(entry.content, {
                 apiKey,
                 model: config.extraction.model,
-                onError: (msg) => console.error(`  (extraction failed: ${msg})`),
+                onError: (msg) => printError(`  (extraction failed: ${msg})`),
             });
             if (facts.length > 0) {
                 storeExtractedFacts(targetRoot, entry, facts);
-                console.error(`  extracted ${facts.length} fact(s)`);
+                printError(`  extracted ${facts.length} fact(s)`);
             }
         }
         catch (err) {
             // Extraction is best-effort: report it, never block remember.
-            console.error(`  (extraction failed: ${err instanceof Error ? err.message : String(err)})`);
+            printError(`  (extraction failed: ${err instanceof Error ? err.message : String(err)})`);
         }
     }
     else if (shouldExtract && !apiKey) {
-        console.error('  (extraction skipped: ANTHROPIC_API_KEY not set)');
+        printError('  (extraction skipped: ANTHROPIC_API_KEY not set)');
     }
 }
 function cmdSupersede(hippoRoot, oldId, newContent, flags) {
     requireInit(hippoRoot);
     const old = readEntry(hippoRoot, oldId, resolveTenantId({}));
     if (!old) {
-        console.error(`Error: memory ${oldId} not found.`);
+        printError(`Error: memory ${oldId} not found.`);
         process.exit(1);
     }
     if (old.superseded_by) {
-        console.error(`Error: memory ${oldId} is already superseded by ${old.superseded_by}. Supersede that one instead.`);
+        printError(`Error: memory ${oldId} is already superseded by ${old.superseded_by}. Supersede that one instead.`);
         process.exit(1);
     }
     const layer = typeof flags['layer'] === 'string' ? flags['layer'] : undefined;
@@ -761,7 +769,7 @@ function cmdSupersede(hippoRoot, oldId, newContent, flags) {
     }
     catch (err) {
         if (err instanceof RejectedValueError) {
-            console.error(`Error: ${err.message}`);
+            printError(`Error: ${err.message}`);
             process.exit(1);
         }
         throw err;
@@ -773,7 +781,7 @@ function cmdSupersede(hippoRoot, oldId, newContent, flags) {
 }
 function failWith(message) {
     return () => {
-        console.error(message);
+        printError(message);
         process.exit(1);
     };
 }
@@ -835,7 +843,7 @@ function parseRerankerFlag(flags) {
         return {};
     const topK = flags['reranker-top-k'] !== undefined
         ? parseInt(String(flags['reranker-top-k']), 10)
-        : name === 'jev' ? JEV_DEFAULT_TOP_K : 50;
+        : name === 'jev' || isClefModel(name) ? JEV_DEFAULT_TOP_K : 50;
     return { value: { fn, topK } };
 }
 function parseSalienceFlag(flags) {
@@ -913,7 +921,7 @@ async function cmdRecall(hippoRoot, query, flags) {
     const entryText = (r) => recallEntryText(r, query, showWhy, primaryIsGlobal || (globalOn && !localIndex.entries[r.entry.id]));
     const printCost = (r) => printedTokens(entryText(r));
     const entryBudget = Math.max(0, budget - printedTokens(recallHeading(budget, budget, query)));
-    const rank = await rankRecall({ hippoRoot, globalRoot: globalRoot !== hippoRoot && globalOn ? globalRoot : undefined, tenantId, note: (line) => console.error(line) }, {
+    const rank = await rankRecall({ hippoRoot, globalRoot: globalRoot !== hippoRoot && globalOn ? globalRoot : undefined, tenantId, note: (line) => printError(line) }, {
         query, budget: entryBudget, cost: printCost, limit, why: showWhy, includeSuperseded, asOf,
         explicitScope: recallExplicitScope, activeScope: recallActiveScope,
         search: { ...engineFlags(flags, config), multihop: flags['multihop'] === true || config.multihop.enabled, graphStream, minResults, explain: false },
@@ -1277,7 +1285,7 @@ function noteScopeHidden(hippoRoot, globalRoot, query, tenantId, requested) {
     // Window-capped, so the count is a floor on large stores; fine for a "why is my row missing" hint.
     const hidden = probe.filter((e) => !api.passesCliRecallScopeFilter(e.scope ?? null, requested)).length;
     if (hidden > 0) {
-        console.error(`[note] ${hidden} candidate${hidden === 1 ? '' : 's'} hidden by recall scope policy (pass an explicit --scope to inspect).`);
+        printError(`[note] ${hidden} candidate${hidden === 1 ? '' : 's'} hidden by recall scope policy (pass an explicit --scope to inspect).`);
     }
 }
 async function cmdExplain(hippoRoot, query, flags) {
@@ -1437,7 +1445,7 @@ async function cmdEval(hippoRoot, corpusPath, flags) {
                 baseline = JSON.parse(fs.readFileSync(baselinePath, 'utf8'));
             }
             catch {
-                console.error(`Warning: eval baseline ${baselinePath} is unreadable; running without it.`);
+                printError(`Warning: eval baseline ${baselinePath} is unreadable; running without it.`);
             }
         }
         const result = await runFeatureEval(version);
@@ -1462,11 +1470,11 @@ async function cmdEval(hippoRoot, corpusPath, flags) {
         return;
     }
     if (!corpusPath) {
-        console.error('Usage: hippo eval <corpus.json>  OR  hippo eval --suite [--save-baseline]  OR  hippo eval --bootstrap');
+        printError('Usage: hippo eval <corpus.json>  OR  hippo eval --suite [--save-baseline]  OR  hippo eval --bootstrap');
         process.exit(1);
     }
     if (!fs.existsSync(corpusPath)) {
-        console.error(`Corpus file not found: ${corpusPath}`);
+        printError(`Corpus file not found: ${corpusPath}`);
         process.exit(1);
     }
     let cases;
@@ -1477,7 +1485,7 @@ async function cmdEval(hippoRoot, corpusPath, flags) {
             throw new Error('Corpus JSON must be an array or { cases: [...] }');
     }
     catch (err) {
-        console.error(`Failed to read corpus: ${err instanceof Error ? err.message : err}`);
+        printError(`Failed to read corpus: ${err instanceof Error ? err.message : err}`);
         process.exit(1);
     }
     const globalRoot = getGlobalRoot();
@@ -1535,12 +1543,12 @@ async function cmdEval(hippoRoot, corpusPath, flags) {
         }
     }
     if (minMrr !== null && summary.meanMrr < minMrr) {
-        console.error(`MRR ${fmt(summary.meanMrr, 4)} below threshold ${minMrr}`);
+        printError(`MRR ${fmt(summary.meanMrr, 4)} below threshold ${minMrr}`);
         process.exit(1);
     }
     if (comparePath) {
         if (!fs.existsSync(comparePath)) {
-            console.error(`Baseline file not found: ${comparePath}`);
+            printError(`Baseline file not found: ${comparePath}`);
             process.exit(1);
         }
         let baseline;
@@ -1548,14 +1556,14 @@ async function cmdEval(hippoRoot, corpusPath, flags) {
             baseline = JSON.parse(fs.readFileSync(comparePath, 'utf8'));
         }
         catch (err) {
-            console.error(`Failed to parse baseline: ${err instanceof Error ? err.message : err}`);
+            printError(`Failed to parse baseline: ${err instanceof Error ? err.message : err}`);
             process.exit(1);
         }
         const cmp = compareSummaries(baseline, summary);
         if (asJson) {
             // The main JSON output already emitted; append comparison to stderr so
             // both can be captured independently.
-            console.error(JSON.stringify({ compare: cmp }, null, 2));
+            printError(JSON.stringify({ compare: cmp }, null, 2));
         }
         else {
             console.log();
@@ -1592,11 +1600,11 @@ function cmdTraceRecord(hippoRoot, flags) {
     const outcome = String(flags['outcome'] ?? '').trim();
     const validOutcomes = ['success', 'failure', 'partial'];
     if (!task || !stepsJson || !outcome) {
-        console.error('Usage: hippo trace record --task <t> --steps <json> --outcome <success|failure|partial> [--session <id>] [--tag <t>]');
+        printError('Usage: hippo trace record --task <t> --steps <json> --outcome <success|failure|partial> [--session <id>] [--tag <t>]');
         process.exit(1);
     }
     if (!validOutcomes.includes(outcome)) {
-        console.error(`Invalid outcome: "${outcome}". Must be one of: ${validOutcomes.join(', ')}.`);
+        printError(`Invalid outcome: "${outcome}". Must be one of: ${validOutcomes.join(', ')}.`);
         process.exit(1);
     }
     let steps;
@@ -1604,7 +1612,7 @@ function cmdTraceRecord(hippoRoot, flags) {
         steps = parseSteps(stepsJson);
     }
     catch (err) {
-        console.error(String(err instanceof Error ? err.message : err));
+        printError(String(err instanceof Error ? err.message : err));
         process.exit(1);
     }
     const sessionId = String(flags['session'] ?? '').trim() || null;
@@ -1644,7 +1652,7 @@ function cmdTrace(hippoRoot, id, flags) {
         sourceLabel = 'global';
     }
     if (!entry) {
-        console.error(`Memory not found: ${id}`);
+        printError(`Memory not found: ${id}`);
         process.exit(1);
     }
     const now = evalNow();
@@ -1739,7 +1747,7 @@ async function cmdRefine(hippoRoot, flags) {
     requireInit(hippoRoot);
     const apiKey = process.env.ANTHROPIC_API_KEY;
     if (!apiKey) {
-        console.error('hippo refine needs ANTHROPIC_API_KEY in the environment.');
+        printError('hippo refine needs ANTHROPIC_API_KEY in the environment.');
         process.exit(1);
     }
     const dryRun = Boolean(flags['dry-run']);
@@ -1774,7 +1782,7 @@ function cmdDedup(hippoRoot, flags) {
     requireInit(hippoRoot);
     const dryRun = Boolean(flags['dry-run']);
     if (flags['threshold'] !== undefined) {
-        console.error('hippo dedup: --threshold is ignored; a duplicate is the same text apart from spacing.');
+        printError('hippo dedup: --threshold is ignored; a duplicate is the same text apart from spacing.');
     }
     const entries = loadAllEntries(hippoRoot);
     console.log(`Scanning ${entries.length} memories for duplicates (same text apart from spacing)${dryRun ? ' (dry run)' : ''}...\n`);
@@ -1826,14 +1834,15 @@ function cmdLastSleep(flags) {
         content = fs.readFileSync(logPath, 'utf8');
     }
     catch {
+        // Removed or locked since the exists check: there is nothing to show this session.
         return;
     }
     if (content.trim().length > 0) {
-        console.error('=== Previous session hippo consolidation ===');
+        printError('=== Previous session hippo consolidation ===');
         process.stderr.write(content);
         if (!content.endsWith('\n'))
-            console.error();
-        console.error('===========================================');
+            printError();
+        printError('===========================================');
     }
     if (!flags['keep']) {
         try {
@@ -1884,6 +1893,7 @@ function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
                 payload = JSON.parse(stdinText.trim());
             }
             catch {
+                // Malformed JSON is handled as a null payload by the fail-closed check below.
                 payload = null;
             }
             if (!payload || typeof payload !== 'object') {
@@ -1908,6 +1918,10 @@ function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
                 }
             }
         }
+        // A compaction follows a prompt or SessionStart that booked the arm, so this only reads it.
+        if (!suppressOutput && payloadSessionId !== null && inPilotHoldout(hippoRoot, resolveTenantId({}), payloadSessionId, false)) {
+            suppressOutput = true;
+        }
         if (!suppressOutput) {
             const tenantId = resolveTenantId({});
             const snapshot = loadFreshActiveTaskSnapshot(hippoRoot, tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
@@ -1930,7 +1944,7 @@ function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
                     }
                 }
                 catch (err) {
-                    console.error(`hippo compact-resume: trail skipped: ${err instanceof Error ? err.message : String(err)}`);
+                    log.warn(`hippo compact-resume: trail skipped: ${err instanceof Error ? err.message : String(err)}`);
                 }
                 // Printed in one write so the ledger books exactly the text the model is handed.
                 const text = captureConsole(() => {
@@ -1953,7 +1967,7 @@ function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
     }
     catch (err) {
         // Empty stdout on any store error, never a crashed SessionStart; the reason goes to stderr, which the model never sees.
-        console.error(`hippo compact-resume: skipped: ${err instanceof Error ? err.message : String(err)}`);
+        log.warn(`hippo compact-resume: skipped: ${err instanceof Error ? err.message : String(err)}`);
     }
     process.exit(0);
 }
@@ -2192,7 +2206,7 @@ function cmdCodexRun(hippoRoot, args) {
     }
     const child = spawnRealCodex(metadata.realCodexPath, args, process.cwd());
     child.on('error', (err) => {
-        console.error(`Failed to launch Codex: ${err.message}`);
+        printError(`Failed to launch Codex: ${err.message}`);
         process.exit(1);
     });
     child.on('exit', async (code, signal) => {
@@ -2239,6 +2253,7 @@ function cmdCodexRun(hippoRoot, args) {
                 process.kill(process.pid, signal);
             }
             catch {
+                // Cannot re-raise the child's signal on this platform; a non-zero exit still reports the failure.
                 process.exit(1);
             }
             return;
@@ -2409,6 +2424,7 @@ function cmdStatus(hippoRoot) {
             return resolveEmbeddingProvider(hippoRoot);
         }
         catch {
+            // Status reports a bad provider config as "misconfigured" below instead of failing.
             return null;
         }
     })();
@@ -2485,7 +2501,7 @@ function cmdOutcome(hippoRoot, flags) {
     const good = Boolean(flags['good']);
     const bad = Boolean(flags['bad']);
     if (!good && !bad) {
-        console.error('Specify --good or --bad');
+        printError('Specify --good or --bad');
         process.exit(1);
     }
     // Behavior fix (v1.11.3): cmdOutcome used to bypass api.outcome and do its
@@ -2528,7 +2544,7 @@ function cmdForget(hippoRoot, id, flags) {
     if (flags['archive'] === true) {
         const reason = typeof flags['reason'] === 'string' ? flags['reason'] : null;
         if (!reason) {
-            console.error(ARCHIVE_REASON_REQUIRED);
+            printError(ARCHIVE_REASON_REQUIRED);
             process.exit(1);
         }
         try {
@@ -2536,7 +2552,7 @@ function cmdForget(hippoRoot, id, flags) {
             console.log(`Archived ${id}`);
         }
         catch (err) {
-            console.error(`Could not archive ${id}: ${err instanceof Error ? err.message : String(err)}`);
+            printError(`Could not archive ${id}: ${err instanceof Error ? err.message : String(err)}`);
             process.exit(1);
         }
         return;
@@ -2550,16 +2566,16 @@ function cmdForget(hippoRoot, id, flags) {
         if (/append-only/i.test(msg)) {
             // The delete was refused by the append-only trigger — this is a raw
             // memory, not a missing one. Point the user at the archive path.
-            console.error(rawForgetRefusal(id));
+            printError(rawForgetRefusal(id));
         }
         else if (api.isDormant(ctx, id)) {
             // Sleep moved it to the dormant store: it is not in active memory, so
             // point at the command that owns it.
-            console.error(`${id} is dormant, not in active memory. Delete it for good: hippo dormant forget ${id} ` +
+            printError(`${id} is dormant, not in active memory. Delete it for good: hippo dormant forget ${id} ` +
                 `(or bring it back: hippo dormant restore ${id})`);
         }
         else {
-            console.error(`Memory not found: ${id}`);
+            printError(`Memory not found: ${id}`);
         }
         process.exit(1);
     }
@@ -2572,15 +2588,15 @@ function previewForget(hippoRoot, id, archive) {
     requireInit(hippoRoot);
     const entry = readEntry(hippoRoot, id, resolveTenantId({}));
     if (!entry) {
-        console.error(`Memory not found: ${id}`);
+        printError(`Memory not found: ${id}`);
         process.exit(1);
     }
     if (!archive && entry.kind === 'raw') {
-        console.error(rawForgetRefusal(id));
+        printError(rawForgetRefusal(id));
         process.exit(1);
     }
     if (archive && entry.kind !== 'raw') {
-        console.error(`Could not archive ${id}: memory ${id} is not raw (kind=${entry.kind})`);
+        printError(`Could not archive ${id}: memory ${id} is not raw (kind=${entry.kind})`);
         process.exit(1);
     }
     const snippet = entry.content.length > 80 ? `${entry.content.slice(0, 80)}...` : entry.content;
@@ -2590,7 +2606,7 @@ function cmdInspect(hippoRoot, id) {
     requireInit(hippoRoot);
     const entry = readEntry(hippoRoot, id, resolveTenantId({}));
     if (!entry) {
-        console.error(`Memory not found: ${id}`);
+        printError(`Memory not found: ${id}`);
         process.exit(1);
     }
     const now = evalNow();
@@ -2653,7 +2669,7 @@ function cmdResolve(hippoRoot, args, flags) {
     // Accept "42" or "conflict_42"
     const conflictId = parseInt(rawId.replace(/^conflict_/, ''), 10);
     if (isNaN(conflictId)) {
-        console.error('Usage: hippo resolve <conflict_id> --keep <memory_id> [--forget]');
+        printError('Usage: hippo resolve <conflict_id> --keep <memory_id> [--forget]');
         process.exit(1);
     }
     const tenantId = resolveTenantId({});
@@ -2663,7 +2679,7 @@ function cmdResolve(hippoRoot, args, flags) {
         const conflicts = listMemoryConflicts(hippoRoot, 'open', tenantId);
         const conflict = conflicts.find((c) => c.id === conflictId);
         if (!conflict) {
-            console.error(`Conflict ${conflictId} not found or already resolved.`);
+            printError(`Conflict ${conflictId} not found or already resolved.`);
             process.exit(1);
         }
         console.log(`Conflict ${conflictId}:`);
@@ -2697,7 +2713,7 @@ function cmdResolve(hippoRoot, args, flags) {
         reason: reasonFlag,
     });
     if (!result) {
-        console.error(`Could not resolve conflict ${conflictId}. Check the ID and --keep value.`);
+        printError(`Could not resolve conflict ${conflictId}. Check the ID and --keep value.`);
         process.exit(1);
     }
     const action = rejectLoser
@@ -2720,20 +2736,20 @@ function cmdReject(hippoRoot, args, flags) {
     // content, so reason is its only human-readable identity.
     const reason = typeof flags['reason'] === 'string' ? flags['reason'].trim() : '';
     if (!reason) {
-        console.error('hippo reject requires --reason "<why>" (the tombstone stores no content; reason is its only identity).');
+        printError('hippo reject requires --reason "<why>" (the tombstone stores no content; reason is its only identity).');
         process.exit(1);
     }
     const valueFlag = typeof flags['value'] === 'string' ? flags['value'] : undefined;
     const memoryId = args[0];
     if (!memoryId && valueFlag === undefined) {
-        console.error('Usage: hippo reject <memory-id> --reason "<why>"');
-        console.error('   or: hippo reject --value "<text>" --reason "<why>"');
+        printError('Usage: hippo reject <memory-id> --reason "<why>"');
+        printError('   or: hippo reject --value "<text>" --reason "<why>"');
         process.exit(1);
     }
     if (memoryId && valueFlag !== undefined) {
         // Ambiguous ask: silently preferring one form would ignore the other
         // without feedback (code-review round-1 low).
-        console.error('hippo reject takes EITHER a memory id OR --value, not both.');
+        printError('hippo reject takes EITHER a memory id OR --value, not both.');
         process.exit(1);
     }
     try {
@@ -2763,7 +2779,7 @@ function cmdReject(hippoRoot, args, flags) {
         }
     }
     catch (err) {
-        console.error(`Could not reject: ${err instanceof Error ? err.message : String(err)}`);
+        printError(`Could not reject: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
 }
@@ -2797,18 +2813,18 @@ function cmdUnreject(hippoRoot, args, flags) {
     const tenantId = resolveTenantId({});
     const digestOrPrefix = (args[0] ?? '').trim();
     if (!digestOrPrefix) {
-        console.error('Usage: hippo unreject <digest-or-prefix>');
+        printError('Usage: hippo unreject <digest-or-prefix>');
         process.exit(1);
     }
     const outcome = unrejectValue(root, tenantId, digestOrPrefix, 'cli');
     if (outcome.status === 'not_found') {
-        console.error(`No rejected value matches "${digestOrPrefix}". Run \`hippo rejections\` to list tombstones.`);
+        printError(`No rejected value matches "${digestOrPrefix}". Run \`hippo rejections\` to list tombstones.`);
         process.exit(1);
     }
     if (outcome.status === 'ambiguous') {
-        console.error(`"${digestOrPrefix}" matches ${outcome.candidates.length} tombstones. Use a longer prefix:`);
+        printError(`"${digestOrPrefix}" matches ${outcome.candidates.length} tombstones. Use a longer prefix:`);
         for (const c of outcome.candidates) {
-            console.error(`  ${c.digest.slice(0, 16)}...  ${c.reason ?? 'none given'}`);
+            printError(`  ${c.digest.slice(0, 16)}...  ${c.reason ?? 'none given'}`);
         }
         process.exit(1);
     }
@@ -2831,7 +2847,7 @@ function cmdDormant(hippoRoot, args, flags) {
     if (sub === 'restore' || sub === 'forget') {
         const id = (args[1] ?? '').trim();
         if (!id) {
-            console.error(`Usage: hippo dormant ${sub} <id>`);
+            printError(`Usage: hippo dormant ${sub} <id>`);
             process.exit(1);
         }
         try {
@@ -2846,10 +2862,10 @@ function cmdDormant(hippoRoot, args, flags) {
         }
         catch (err) {
             if (err instanceof RejectedValueError) {
-                console.error(`Cannot restore ${id}: its value was rejected (${err.reason ?? 'no reason given'}). Run \`hippo unreject\` first to allow it.`);
+                printError(`Cannot restore ${id}: its value was rejected (${err.reason ?? 'no reason given'}). Run \`hippo unreject\` first to allow it.`);
             }
             else {
-                console.error(`Could not ${sub} ${id}: ${err instanceof Error ? err.message : String(err)}`);
+                printError(`Could not ${sub} ${id}: ${err instanceof Error ? err.message : String(err)}`);
             }
             process.exit(1);
         }
@@ -2894,7 +2910,7 @@ function cmdQuarantine(hippoRoot, args, flags) {
     if (sub === 'approve' || sub === 'reject') {
         const id = (args[1] ?? '').trim();
         if (!id) {
-            console.error(`Usage: hippo quarantine ${sub} <id>`);
+            printError(`Usage: hippo quarantine ${sub} <id>`);
             process.exit(1);
         }
         try {
@@ -2908,7 +2924,7 @@ function cmdQuarantine(hippoRoot, args, flags) {
             }
         }
         catch (err) {
-            console.error(`Could not ${sub} ${id}: ${err instanceof Error ? err.message : String(err)}`);
+            printError(`Could not ${sub} ${id}: ${err instanceof Error ? err.message : String(err)}`);
             process.exit(1);
         }
         return;
@@ -3025,7 +3041,7 @@ function cmdSnapshot(hippoRoot, args, flags) {
         const nextStep = String(flags['next-step'] ?? '').trim();
         const sessionId = String(flags['session'] ?? flags['id'] ?? '').trim();
         if (!task || !summary || !nextStep) {
-            console.error('Usage: hippo snapshot save --task <task> --summary <summary> --next-step <step> [--source <source>] [--session <session-id>]');
+            printError('Usage: hippo snapshot save --task <task> --summary <summary> --next-step <step> [--source <source>] [--session <session-id>]');
             process.exit(1);
         }
         const snapshot = saveActiveTaskSnapshot(hippoRoot, resolveTenantId({}), {
@@ -3070,7 +3086,7 @@ function cmdSnapshot(hippoRoot, args, flags) {
         printActiveTaskSnapshot(snapshot);
         return;
     }
-    console.error('Usage: hippo snapshot <save|show|clear>');
+    printError('Usage: hippo snapshot <save|show|clear>');
     process.exit(1);
 }
 function cmdSession(hippoRoot, args, flags) {
@@ -3083,7 +3099,7 @@ function cmdSession(hippoRoot, args, flags) {
         const eventType = String(flags['type'] ?? 'note').trim();
         const content = String(flags['content'] ?? '').trim();
         if (!sessionId || !content) {
-            console.error('Usage: hippo session log --id <session-id> --content <text> [--type <type>] [--task <task>] [--source <source>]');
+            printError('Usage: hippo session log --id <session-id> --content <text> [--type <type>] [--task <task>] [--source <source>]');
             process.exit(1);
         }
         const event = appendSessionEvent(hippoRoot, resolveTenantId({}), {
@@ -3135,11 +3151,11 @@ function cmdSession(hippoRoot, args, flags) {
         const outcomeRaw = String(flags['outcome'] ?? '').trim();
         const summary = String(flags['summary'] ?? '').trim();
         if (!sessionId) {
-            console.error('Usage: hippo session complete --session <session-id> --outcome <success|failure|partial> [--summary "..."]');
+            printError('Usage: hippo session complete --session <session-id> --outcome <success|failure|partial> [--summary "..."]');
             process.exit(1);
         }
         if (!isHandoffOutcome(outcomeRaw)) {
-            console.error(`Invalid outcome: "${outcomeRaw}". Must be one of: success, failure, partial.`);
+            printError(`Invalid outcome: "${outcomeRaw}". Must be one of: success, failure, partial.`);
             process.exit(1);
         }
         const outcome = outcomeRaw;
@@ -3206,7 +3222,7 @@ function cmdSession(hippoRoot, args, flags) {
         console.log(lines.join('\n'));
         return;
     }
-    console.error('Usage: hippo session <log|show|latest|resume|complete>');
+    printError('Usage: hippo session <log|show|latest|resume|complete>');
     process.exit(1);
 }
 function cmdHandoff(hippoRoot, args, flags) {
@@ -3215,12 +3231,12 @@ function cmdHandoff(hippoRoot, args, flags) {
     if (subcommand === 'create') {
         const summary = String(flags['summary'] ?? '').trim();
         if (!summary) {
-            console.error('Usage: hippo handoff create --summary "..." [--next "..."] [--session <id>] [--task <id>] [--artifact <path>...] [--constraint <text>...] [--outcome <success|failure|partial>] [--target-runtime <name>] [--card-id <id>] [--tests <pass|fail|unknown>]');
+            printError('Usage: hippo handoff create --summary "..." [--next "..."] [--session <id>] [--task <id>] [--artifact <path>...] [--constraint <text>...] [--outcome <success|failure|partial>] [--target-runtime <name>] [--card-id <id>] [--tests <pass|fail|unknown>]');
             process.exit(1);
         }
         const outcomeRaw = flags['outcome'];
         if (outcomeRaw !== undefined && !isHandoffOutcome(outcomeRaw)) {
-            console.error(`Invalid outcome: "${String(outcomeRaw)}". Must be one of: success, failure, partial.`);
+            printError(`Invalid outcome: "${String(outcomeRaw)}". Must be one of: success, failure, partial.`);
             process.exit(1);
         }
         const sessionId = String(flags['session'] ?? flags['id'] ?? '').trim() || `fallback-${Date.now()}-${process.pid}`;
@@ -3238,7 +3254,7 @@ function cmdHandoff(hippoRoot, args, flags) {
         for (const name of ['target-runtime', 'card-id']) {
             // parseArgs turns a value-less flag into `true`; refuse rather than store "true".
             if (flags[name] === true) {
-                console.error(`--${name} needs a value`);
+                printError(`--${name} needs a value`);
                 process.exit(1);
             }
         }
@@ -3303,12 +3319,12 @@ function cmdHandoff(hippoRoot, args, flags) {
     if (subcommand === 'show') {
         const idArg = args[1];
         if (!idArg) {
-            console.error('Usage: hippo handoff show <id> [--json]');
+            printError('Usage: hippo handoff show <id> [--json]');
             process.exit(1);
         }
         const handoffId = parseInt(idArg, 10);
         if (!Number.isFinite(handoffId) || handoffId <= 0) {
-            console.error(`Invalid handoff ID: ${idArg}`);
+            printError(`Invalid handoff ID: ${idArg}`);
             process.exit(1);
         }
         const handoff = loadHandoffById(hippoRoot, resolveTenantId({}), handoffId);
@@ -3328,7 +3344,7 @@ function cmdHandoff(hippoRoot, args, flags) {
         printHandoff(handoff);
         return;
     }
-    console.error('Usage: hippo handoff <create|latest|show>');
+    printError('Usage: hippo handoff <create|latest|show>');
     process.exit(1);
 }
 // Mirrors ARCHIVE_REASON_REQUIRED so the block message can't drift from its usage line.
@@ -3381,7 +3397,7 @@ function cardRunFlag(flags) {
         return undefined;
     const n = Number(raw);
     if (!/^\d+$/.test(raw) || !Number.isSafeInteger(n) || n <= 0) {
-        console.error(`Invalid --run: "${raw}" (expected a positive integer).`);
+        printError(`Invalid --run: "${raw}" (expected a positive integer).`);
         process.exit(1);
     }
     return n;
@@ -3414,7 +3430,7 @@ function cmdCard(hippoRoot, args, flags) {
         for (const key of Object.keys(flags)) {
             if (!allowedFlags.includes(key)) {
                 const valid = allowedFlags.length > 0 ? allowedFlags.map((f) => `--${f}`).join(', ') : '(none)';
-                console.error(`Unknown flag --${key} for hippo card ${subcommand}. Valid flags: ${valid}`);
+                printError(`Unknown flag --${key} for hippo card ${subcommand}. Valid flags: ${valid}`);
                 process.exit(1);
             }
         }
@@ -3422,7 +3438,7 @@ function cmdCard(hippoRoot, args, flags) {
     if (subcommand === 'create') {
         const title = cardStringFlag(flags, 'title') ?? '';
         if (!title) {
-            console.error('Usage: hippo card create --title "..." [--repo <name>] [--contract <text>] [--budget <n>] [--depends-on <id>...]');
+            printError('Usage: hippo card create --title "..." [--repo <name>] [--contract <text>] [--budget <n>] [--depends-on <id>...]');
             process.exit(1);
         }
         const repo = cardStringFlag(flags, 'repo') || undefined;
@@ -3431,14 +3447,14 @@ function cmdCard(hippoRoot, args, flags) {
         let budget;
         if (budgetRaw !== undefined) {
             if (!/^\d+$/.test(budgetRaw)) {
-                console.error(`Invalid budget: "${budgetRaw}" (expected a positive integer)`);
+                printError(`Invalid budget: "${budgetRaw}" (expected a positive integer)`);
                 process.exit(1);
             }
             budget = Number(budgetRaw);
         }
         const dependsOnFlag = flags['depends-on'];
         if (dependsOnFlag === true) {
-            console.error('--depends-on requires a value');
+            printError('--depends-on requires a value');
             process.exit(1);
         }
         const dependsOn = Array.isArray(dependsOnFlag) ? dependsOnFlag : [];
@@ -3447,7 +3463,7 @@ function cmdCard(hippoRoot, args, flags) {
             card = createCard(hippoRoot, tenantId, { title, repo, contract, budget, dependsOn });
         }
         catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
+            printError(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
         console.log(`Created card ${card.id} (status: ${card.status})`);
@@ -3456,12 +3472,12 @@ function cmdCard(hippoRoot, args, flags) {
     if (subcommand === 'show') {
         const id = args[1];
         if (!id) {
-            console.error('Usage: hippo card show <id> [--json]');
+            printError('Usage: hippo card show <id> [--json]');
             process.exit(1);
         }
         const detail = loadCardDetail(hippoRoot, tenantId, id);
         if (!detail) {
-            console.error(`No card found with id ${id}.`);
+            printError(`No card found with id ${id}.`);
             process.exit(1);
         }
         if (flags['json']) {
@@ -3474,7 +3490,7 @@ function cmdCard(hippoRoot, args, flags) {
     if (subcommand === 'list') {
         const status = cardStringFlag(flags, 'status');
         if (status !== undefined && !isCardStatus(status)) {
-            console.error(`Invalid status: "${status}".`);
+            printError(`Invalid status: "${status}".`);
             process.exit(1);
         }
         const cards = listCards(hippoRoot, tenantId, { status });
@@ -3495,7 +3511,7 @@ function cmdCard(hippoRoot, args, flags) {
         const id = args[1];
         const runtime = cardStringFlag(flags, 'runtime') ?? '';
         if (!id || !runtime) {
-            console.error('Usage: hippo card claim <id> --runtime <name> [--session <id>]');
+            printError('Usage: hippo card claim <id> --runtime <name> [--session <id>]');
             process.exit(1);
         }
         const sessionId = cardStringFlag(flags, 'session') || undefined;
@@ -3504,11 +3520,11 @@ function cmdCard(hippoRoot, args, flags) {
             card = claimCard(hippoRoot, tenantId, id, runtime, sessionId);
         }
         catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
+            printError(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
         if (!card) {
-            console.error(`Could not claim card ${id} (not ready/blocked, or already claimed).`);
+            printError(`Could not claim card ${id} (not ready/blocked, or already claimed).`);
             process.exit(1);
         }
         console.log(`Claimed card ${card.id} for ${runtime} (run ${card.runId}, lease until ${card.leaseUntil})`);
@@ -3518,7 +3534,7 @@ function cmdCard(hippoRoot, args, flags) {
         const id = args[1];
         const runId = cardRunFlag(flags);
         if (!id || runId === undefined) {
-            console.error('Usage: hippo card heartbeat <id> --run <n>');
+            printError('Usage: hippo card heartbeat <id> --run <n>');
             process.exit(1);
         }
         let card;
@@ -3526,11 +3542,11 @@ function cmdCard(hippoRoot, args, flags) {
             card = heartbeatCard(hippoRoot, tenantId, id, runId);
         }
         catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
+            printError(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
         if (!card) {
-            console.error(`Could not heartbeat card ${id} (${cardRefusal(hippoRoot, tenantId, id)}).`);
+            printError(`Could not heartbeat card ${id} (${cardRefusal(hippoRoot, tenantId, id)}).`);
             process.exit(1);
         }
         console.log(`Heartbeat card ${card.id}: lease until ${card.leaseUntil}`);
@@ -3540,7 +3556,7 @@ function cmdCard(hippoRoot, args, flags) {
         const id = args[1];
         const reason = cardStringFlag(flags, 'reason') ?? '';
         if (!id || !reason) {
-            console.error(CARD_BLOCK_REASON_REQUIRED);
+            printError(CARD_BLOCK_REASON_REQUIRED);
             process.exit(1);
         }
         const runId = cardRunFlag(flags);
@@ -3549,12 +3565,12 @@ function cmdCard(hippoRoot, args, flags) {
             card = blockCard(hippoRoot, tenantId, id, reason, runId);
         }
         catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
+            printError(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
         if (!card) {
             const why = runId === undefined ? 'not running' : cardRefusal(hippoRoot, tenantId, id);
-            console.error(`Could not block card ${id} (${why}).`);
+            printError(`Could not block card ${id} (${why}).`);
             process.exit(1);
         }
         console.log(`Blocked card ${card.id}`);
@@ -3563,7 +3579,7 @@ function cmdCard(hippoRoot, args, flags) {
     if (subcommand === 'review') {
         const id = args[1];
         if (!id) {
-            console.error('Usage: hippo card review <id> [--run <n>]');
+            printError('Usage: hippo card review <id> [--run <n>]');
             process.exit(1);
         }
         const runId = cardRunFlag(flags);
@@ -3572,12 +3588,12 @@ function cmdCard(hippoRoot, args, flags) {
             card = reviewCard(hippoRoot, tenantId, id, runId);
         }
         catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
+            printError(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
         if (!card) {
             const why = runId === undefined ? 'not running' : cardRefusal(hippoRoot, tenantId, id);
-            console.error(`Could not move card ${id} to review (${why}).`);
+            printError(`Could not move card ${id} to review (${why}).`);
             process.exit(1);
         }
         console.log(`Card ${card.id} moved to review`);
@@ -3587,7 +3603,7 @@ function cmdCard(hippoRoot, args, flags) {
         const id = args[1];
         const outcomeRaw = flags['outcome'];
         if (!id || !isHandoffOutcome(outcomeRaw)) {
-            console.error('Usage: hippo card complete <id> --outcome <success|failure|partial> [--run <n>]');
+            printError('Usage: hippo card complete <id> --outcome <success|failure|partial> [--run <n>]');
             process.exit(1);
         }
         const runId = cardRunFlag(flags);
@@ -3596,12 +3612,12 @@ function cmdCard(hippoRoot, args, flags) {
             result = completeCard(hippoRoot, tenantId, id, outcomeRaw, runId);
         }
         catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
+            printError(error instanceof Error ? error.message : String(error));
             process.exit(1);
         }
         if (!result) {
             const why = runId === undefined ? 'not in review' : cardRefusal(hippoRoot, tenantId, id);
-            console.error(`Could not complete card ${id} (${why}).`);
+            printError(`Could not complete card ${id} (${why}).`);
             process.exit(1);
         }
         console.log(`Completed card ${result.card.id} (status: ${result.card.status})`);
@@ -3612,7 +3628,7 @@ function cmdCard(hippoRoot, args, flags) {
     }
     if (subcommand === 'reclaim') {
         if (args.length > 1) {
-            console.error('Usage: hippo card reclaim (sweeps every expired lease; use hippo card block <id> for one card)');
+            printError('Usage: hippo card reclaim (sweeps every expired lease; use hippo card block <id> for one card)');
             process.exit(1);
         }
         const ids = reclaimExpiredCards(hippoRoot, tenantId);
@@ -3628,18 +3644,18 @@ function cmdCard(hippoRoot, args, flags) {
     if (subcommand === 'comment') {
         const id = args[1];
         if (!id) {
-            console.error('Usage: hippo card comment <id> --body "..." [--author <name>]');
+            printError('Usage: hippo card comment <id> --body "..." [--author <name>]');
             process.exit(1);
         }
         // Only show and comment look the card up directly; claim/heartbeat/block/review/complete throw from the store instead.
         const card = loadCard(hippoRoot, tenantId, id);
         if (!card) {
-            console.error(`No card found with id ${id}.`);
+            printError(`No card found with id ${id}.`);
             process.exit(1);
         }
         const body = cardStringFlag(flags, 'body') ?? '';
         if (!body) {
-            console.error('Usage: hippo card comment <id> --body "..." [--author <name>]');
+            printError('Usage: hippo card comment <id> --body "..." [--author <name>]');
             process.exit(1);
         }
         const author = cardStringFlag(flags, 'author') || 'cli';
@@ -3647,7 +3663,7 @@ function cmdCard(hippoRoot, args, flags) {
         console.log(`Added comment ${comment.id} to card ${id}`);
         return;
     }
-    console.error('Usage: hippo card <create|show|list|claim|heartbeat|block|review|complete|reclaim|comment>');
+    printError('Usage: hippo card <create|show|list|claim|heartbeat|block|review|complete|reclaim|comment>');
     process.exit(1);
 }
 // ---------------------------------------------------------------------------
@@ -3661,23 +3677,23 @@ function cmdPredict(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo predict close <id> --state <closed|closed-unknown> [--actual <v>] [--note "..."]');
+            printError('Usage: hippo predict close <id> --state <closed|closed-unknown> [--actual <v>] [--note "..."]');
             process.exit(1);
         }
         const id = parseInt(String(idRaw), 10);
         if (!Number.isFinite(id) || id <= 0) {
-            console.error(`Invalid prediction id: "${idRaw}"`);
+            printError(`Invalid prediction id: "${idRaw}"`);
             process.exit(1);
         }
         const stateRaw = typeof flags['state'] === 'string' ? flags['state'].trim() : '';
         if (!predictionsModule.VALID_CLOSURE_STATES.has(stateRaw) || stateRaw === 'open') {
-            console.error(`Invalid --state: "${stateRaw}". Must be one of: closed | closed-unknown.`);
+            printError(`Invalid --state: "${stateRaw}". Must be one of: closed | closed-unknown.`);
             process.exit(1);
         }
         const actualRaw = flags['actual'];
         const actualValue = actualRaw !== undefined ? Number(actualRaw) : undefined;
         if (actualRaw !== undefined && !Number.isFinite(actualValue)) {
-            console.error(`Invalid --actual: "${actualRaw}". Must be a number.`);
+            printError(`Invalid --actual: "${actualRaw}". Must be a number.`);
             process.exit(1);
         }
         const noteRaw = flags['note'];
@@ -3698,7 +3714,7 @@ function cmdPredict(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         let results;
@@ -3722,7 +3738,7 @@ function cmdPredict(hippoRoot, args, flags) {
         }
         else {
             if (!predictionsModule.VALID_CLOSURE_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: open | closed | closed-unknown | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: open | closed | closed-unknown | all.`);
                 process.exit(1);
             }
             if (classTag) {
@@ -3733,7 +3749,7 @@ function cmdPredict(hippoRoot, args, flags) {
             }
             else {
                 // status filter without class — scan all classes is more complex; v1 requires --class for non-default status
-                console.error('--status filter (non-open) requires --class to be set.');
+                printError('--status filter (non-open) requires --class to be set.');
                 process.exit(1);
             }
         }
@@ -3756,17 +3772,17 @@ function cmdPredict(hippoRoot, args, flags) {
     if (subcommand === 'show') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo predict show <id>');
+            printError('Usage: hippo predict show <id>');
             process.exit(1);
         }
         const id = parseInt(String(idRaw), 10);
         if (!Number.isFinite(id) || id <= 0) {
-            console.error(`Invalid prediction id: "${idRaw}"`);
+            printError(`Invalid prediction id: "${idRaw}"`);
             process.exit(1);
         }
         const pred = predictionsModule.loadPredictionById(hippoRoot, tenantId, id);
         if (!pred) {
-            console.error(`Prediction ${id} not found.`);
+            printError(`Prediction ${id} not found.`);
             process.exit(1);
         }
         console.log(`Prediction #${pred.id}`);
@@ -3792,7 +3808,7 @@ function cmdPredict(hippoRoot, args, flags) {
         // J3 reference-class / planning-fallacy detector
         const classTagRaw = flags['class'];
         if (typeof classTagRaw !== 'string' || !classTagRaw.trim()) {
-            console.error('Usage: hippo predict baserate --class <c>');
+            printError('Usage: hippo predict baserate --class <c>');
             process.exit(1);
         }
         const baserate = predictionsModule.computePredictionBaserate(hippoRoot, tenantId, classTagRaw.trim());
@@ -3820,22 +3836,22 @@ function cmdPredict(hippoRoot, args, flags) {
     // Default subcommand: create. args[0] is the claim text.
     const claimText = subcommand;
     if (!claimText) {
-        console.error('Usage: hippo predict "<claim>" --class <c> [--estimate <v>] [--unit <u>] [--target <YYYY-MM-DD>]');
-        console.error('       hippo predict close <id> --state <closed|closed-unknown> [--actual <v>] [--note "..."]');
-        console.error('       hippo predict list [--class X] [--status open|closed|closed-unknown|all] [--limit N]');
-        console.error('       hippo predict show <id>');
+        printError('Usage: hippo predict "<claim>" --class <c> [--estimate <v>] [--unit <u>] [--target <YYYY-MM-DD>]');
+        printError('       hippo predict close <id> --state <closed|closed-unknown> [--actual <v>] [--note "..."]');
+        printError('       hippo predict list [--class X] [--status open|closed|closed-unknown|all] [--limit N]');
+        printError('       hippo predict show <id>');
         process.exit(1);
     }
     const classTagRaw = flags['class'];
     if (typeof classTagRaw !== 'string' || !classTagRaw.trim()) {
-        console.error('--class is required for prediction creation.');
+        printError('--class is required for prediction creation.');
         process.exit(1);
     }
     const classTag = classTagRaw.trim();
     const estimateRaw = flags['estimate'];
     const estimateValue = estimateRaw !== undefined ? Number(estimateRaw) : undefined;
     if (estimateRaw !== undefined && !Number.isFinite(estimateValue)) {
-        console.error(`Invalid --estimate: "${estimateRaw}". Must be a number.`);
+        printError(`Invalid --estimate: "${estimateRaw}". Must be a number.`);
         process.exit(1);
     }
     const unitRaw = flags['unit'];
@@ -3863,7 +3879,7 @@ function cmdDecide(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         let results;
@@ -3872,7 +3888,7 @@ function cmdDecide(hippoRoot, args, flags) {
         }
         else {
             if (!decisionsModule.VALID_DECISION_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
                 process.exit(1);
             }
             results = decisionsModule.loadDecisions(hippoRoot, tenantId, {
@@ -3897,17 +3913,17 @@ function cmdDecide(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo decide get <id>');
+            printError('Usage: hippo decide get <id>');
             process.exit(1);
         }
         const id = parseInt(String(idRaw), 10);
         if (!Number.isFinite(id) || id <= 0) {
-            console.error(`Invalid decision id: "${idRaw}"`);
+            printError(`Invalid decision id: "${idRaw}"`);
             process.exit(1);
         }
         const decision = decisionsModule.loadDecisionById(hippoRoot, tenantId, id);
         if (!decision) {
-            console.error(`Decision ${id} not found.`);
+            printError(`Decision ${id} not found.`);
             process.exit(1);
         }
         console.log(`Decision #${decision.id}`);
@@ -3929,12 +3945,12 @@ function cmdDecide(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo decide close <id>');
+            printError('Usage: hippo decide close <id>');
             process.exit(1);
         }
         const id = parseInt(String(idRaw), 10);
         if (!Number.isFinite(id) || id <= 0) {
-            console.error(`Invalid decision id: "${idRaw}"`);
+            printError(`Invalid decision id: "${idRaw}"`);
             process.exit(1);
         }
         const closed = decisionsModule.closeDecision(hippoRoot, tenantId, id);
@@ -3944,10 +3960,10 @@ function cmdDecide(hippoRoot, args, flags) {
     // Default subcommand: create. args[0] is the decision text.
     const decisionText = subcommand;
     if (!decisionText) {
-        console.error('Usage: hippo decide "<decision>" [--context "<why>"] [--supersedes <memory-id>]');
-        console.error('       hippo decide list [--status active|superseded|closed|all] [--limit N]');
-        console.error('       hippo decide get <id>');
-        console.error('       hippo decide close <id>');
+        printError('Usage: hippo decide "<decision>" [--context "<why>"] [--supersedes <memory-id>]');
+        printError('       hippo decide list [--status active|superseded|closed|all] [--limit N]');
+        printError('       hippo decide get <id>');
+        printError('       hippo decide close <id>');
         process.exit(1);
     }
     const contextRaw = flags['context'];
@@ -3956,7 +3972,7 @@ function cmdDecide(hippoRoot, args, flags) {
     // request: the user asked to supersede but gave no memory id. Reject it rather
     // than silently creating a non-superseding decision (codex review 2026-05-28).
     if (flags['supersedes'] === true) {
-        console.error('--supersedes requires a memory id, e.g. hippo decide "<text>" --supersedes mem_abc123.');
+        printError('--supersedes requires a memory id, e.g. hippo decide "<text>" --supersedes mem_abc123.');
         process.exit(1);
     }
     const supersedesMemId = typeof flags['supersedes'] === 'string' ? flags['supersedes'] : null;
@@ -3970,7 +3986,7 @@ function cmdDecide(hippoRoot, args, flags) {
     if (supersedesMemId) {
         oldEntry = readEntry(hippoRoot, supersedesMemId, tenantId) ?? null;
         if (!oldEntry) {
-            console.error(`Memory ${supersedesMemId} not found.`);
+            printError(`Memory ${supersedesMemId} not found.`);
             process.exit(1);
         }
         supersedesDecisionId =
@@ -4000,7 +4016,7 @@ function cmdDecide(hippoRoot, args, flags) {
             writeEntry(hippoRoot, oldEntry);
         }
         catch (e) {
-            console.error(`  warning: decision recorded and superseded, but failed to weaken the prior memory ${supersedesMemId}: ${e.message}`);
+            printError(`  warning: decision recorded and superseded, but failed to weaken the prior memory ${supersedesMemId}: ${e.message}`);
         }
     }
     console.log(`Decision recorded: #${created.id}`);
@@ -4021,7 +4037,7 @@ function parsePositiveIncidentId(idRaw) {
     const s = String(idRaw ?? '').trim();
     const id = parseInt(s, 10);
     if (!/^\d+$/.test(s) || id <= 0) {
-        console.error(`Invalid incident id: "${idRaw}" (expected a positive integer).`);
+        printError(`Invalid incident id: "${idRaw}" (expected a positive integer).`);
         process.exit(1);
     }
     return id;
@@ -4036,7 +4052,7 @@ function cmdIncident(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         let results;
@@ -4045,7 +4061,7 @@ function cmdIncident(hippoRoot, args, flags) {
         }
         else {
             if (!incidentsModule.VALID_INCIDENT_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: open | resolved | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: open | resolved | closed | all.`);
                 process.exit(1);
             }
             results = incidentsModule.loadIncidents(hippoRoot, tenantId, {
@@ -4070,13 +4086,13 @@ function cmdIncident(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo incident get <id>');
+            printError('Usage: hippo incident get <id>');
             process.exit(1);
         }
         const id = parsePositiveIncidentId(idRaw);
         const incident = incidentsModule.loadIncidentById(hippoRoot, tenantId, id);
         if (!incident) {
-            console.error(`Incident ${id} not found.`);
+            printError(`Incident ${id} not found.`);
             process.exit(1);
         }
         console.log(`Incident #${incident.id}`);
@@ -4101,13 +4117,13 @@ function cmdIncident(hippoRoot, args, flags) {
     if (subcommand === 'resolve') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo incident resolve <id> --resolution "<text>"');
+            printError('Usage: hippo incident resolve <id> --resolution "<text>"');
             process.exit(1);
         }
         const id = parsePositiveIncidentId(idRaw);
         const resolutionRaw = flags['resolution'];
         if (typeof resolutionRaw !== 'string' || !resolutionRaw.trim()) {
-            console.error('--resolution requires a non-empty value, e.g. hippo incident resolve <id> --resolution "root cause fixed".');
+            printError('--resolution requires a non-empty value, e.g. hippo incident resolve <id> --resolution "root cause fixed".');
             process.exit(1);
         }
         const resolved = incidentsModule.resolveIncident(hippoRoot, tenantId, id, resolutionRaw);
@@ -4117,7 +4133,7 @@ function cmdIncident(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo incident close <id>');
+            printError('Usage: hippo incident close <id>');
             process.exit(1);
         }
         const id = parsePositiveIncidentId(idRaw);
@@ -4130,11 +4146,11 @@ function cmdIncident(hippoRoot, args, flags) {
     // `open` keyword the text is args[1], otherwise args[0] IS the text.
     const incidentText = subcommand === 'open' ? (args[1] ?? '') : subcommand;
     if (!incidentText) {
-        console.error('Usage: hippo incident "<incident>" [--context "<details>"] [--link <memory-id>]...');
-        console.error('       hippo incident list [--status open|resolved|closed|all] [--limit N]');
-        console.error('       hippo incident get <id>');
-        console.error('       hippo incident resolve <id> --resolution "<text>"');
-        console.error('       hippo incident close <id>');
+        printError('Usage: hippo incident "<incident>" [--context "<details>"] [--link <memory-id>]...');
+        printError('       hippo incident list [--status open|resolved|closed|all] [--limit N]');
+        printError('       hippo incident get <id>');
+        printError('       hippo incident resolve <id> --resolution "<text>"');
+        printError('       hippo incident close <id>');
         process.exit(1);
     }
     const contextRaw = flags['context'];
@@ -4150,7 +4166,7 @@ function cmdIncident(hippoRoot, args, flags) {
         linkedMemoryIds = [linkRaw];
     }
     else if (linkRaw === true) {
-        console.error('--link requires a memory id, e.g. hippo incident "<text>" --link mem_abc123.');
+        printError('--link requires a memory id, e.g. hippo incident "<text>" --link mem_abc123.');
         process.exit(1);
     }
     const incidentPathTags = extractPathTags(process.cwd());
@@ -4176,7 +4192,7 @@ function parsePositiveProcessId(idRaw) {
     const s = String(idRaw ?? '').trim();
     const id = parseInt(s, 10);
     if (!/^\d+$/.test(s) || id <= 0) {
-        console.error(`Invalid process id: "${idRaw}" (expected a positive integer).`);
+        printError(`Invalid process id: "${idRaw}" (expected a positive integer).`);
         process.exit(1);
     }
     return id;
@@ -4189,7 +4205,7 @@ function collectProcessSteps(stepRaw) {
     if (typeof stepRaw === 'string')
         return [stepRaw];
     if (stepRaw === true) {
-        console.error('--step requires a value, e.g. hippo process new "<name>" --step "do X".');
+        printError('--step requires a value, e.g. hippo process new "<name>" --step "do X".');
         process.exit(1);
     }
     return [];
@@ -4204,7 +4220,7 @@ function cmdProcess(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         let results;
@@ -4213,7 +4229,7 @@ function cmdProcess(hippoRoot, args, flags) {
         }
         else {
             if (!processesModule.VALID_PROCESS_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
                 process.exit(1);
             }
             results = processesModule.loadProcesses(hippoRoot, tenantId, {
@@ -4237,13 +4253,13 @@ function cmdProcess(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo process get <id>');
+            printError('Usage: hippo process get <id>');
             process.exit(1);
         }
         const id = parsePositiveProcessId(idRaw);
         const proc = processesModule.loadProcessById(hippoRoot, tenantId, id);
         if (!proc) {
-            console.error(`Process ${id} not found.`);
+            printError(`Process ${id} not found.`);
             process.exit(1);
         }
         console.log(`Process #${proc.id}`);
@@ -4272,13 +4288,13 @@ function cmdProcess(hippoRoot, args, flags) {
     if (subcommand === 'supersede') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo process supersede <id> --step "<text>" [--step ...] [--change "<summary>"] [--description "<text>"]');
+            printError('Usage: hippo process supersede <id> --step "<text>" [--step ...] [--change "<summary>"] [--description "<text>"]');
             process.exit(1);
         }
         const id = parsePositiveProcessId(idRaw);
         const steps = collectProcessSteps(flags['step']);
         if (steps.length === 0) {
-            console.error('hippo process supersede requires at least one --step "<text>" for the new version.');
+            printError('hippo process supersede requires at least one --step "<text>" for the new version.');
             process.exit(1);
         }
         // A supersession is a new version of the SAME process, so the new row reuses
@@ -4287,7 +4303,7 @@ function cmdProcess(hippoRoot, args, flags) {
         // preflight is the authoritative active-state check.
         const existing = processesModule.loadProcessById(hippoRoot, tenantId, id);
         if (!existing) {
-            console.error(`Process ${id} not found.`);
+            printError(`Process ${id} not found.`);
             process.exit(1);
         }
         const changeRaw = flags['change'];
@@ -4311,7 +4327,7 @@ function cmdProcess(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo process close <id>');
+            printError('Usage: hippo process close <id>');
             process.exit(1);
         }
         const id = parsePositiveProcessId(idRaw);
@@ -4324,11 +4340,11 @@ function cmdProcess(hippoRoot, args, flags) {
     // `new` keyword the name is args[1], otherwise args[0] IS the name.
     const processName = subcommand === 'new' ? (args[1] ?? '') : subcommand;
     if (!processName) {
-        console.error('Usage: hippo process new "<name>" --step "<text>" [--step ...] [--description "<text>"]');
-        console.error('       hippo process list [--status active|superseded|closed|all] [--limit N]');
-        console.error('       hippo process get <id>');
-        console.error('       hippo process supersede <id> --step "<text>" [--change "<summary>"]');
-        console.error('       hippo process close <id>');
+        printError('Usage: hippo process new "<name>" --step "<text>" [--step ...] [--description "<text>"]');
+        printError('       hippo process list [--status active|superseded|closed|all] [--limit N]');
+        printError('       hippo process get <id>');
+        printError('       hippo process supersede <id> --step "<text>" [--change "<summary>"]');
+        printError('       hippo process close <id>');
         process.exit(1);
     }
     const steps = collectProcessSteps(flags['step']);
@@ -4351,7 +4367,7 @@ function parsePositivePolicyId(idRaw) {
     const s = String(idRaw ?? '').trim();
     const id = parseInt(s, 10);
     if (!/^\d+$/.test(s) || id <= 0) {
-        console.error(`Invalid policy id: "${idRaw}" (expected a positive integer).`);
+        printError(`Invalid policy id: "${idRaw}" (expected a positive integer).`);
         process.exit(1);
     }
     return id;
@@ -4373,7 +4389,7 @@ function cmdPolicy(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         let results;
@@ -4382,7 +4398,7 @@ function cmdPolicy(hippoRoot, args, flags) {
         }
         else {
             if (!policiesModule.VALID_POLICY_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
                 process.exit(1);
             }
             results = policiesModule.loadPolicies(hippoRoot, tenantId, {
@@ -4402,7 +4418,7 @@ function cmdPolicy(hippoRoot, args, flags) {
     if (subcommand === 'asof') {
         const dateRaw = args[1];
         if (!dateRaw) {
-            console.error('Usage: hippo policy asof <iso-date> [--name "<policy>"]');
+            printError('Usage: hippo policy asof <iso-date> [--name "<policy>"]');
             process.exit(1);
         }
         const nameRaw = flags['name'];
@@ -4412,7 +4428,7 @@ function cmdPolicy(hippoRoot, args, flags) {
             results = policiesModule.loadPoliciesAsOf(hippoRoot, tenantId, dateRaw, { name });
         }
         catch (e) {
-            console.error(e.message);
+            printError(e.message);
             process.exit(1);
         }
         if (results.length === 0) {
@@ -4427,13 +4443,13 @@ function cmdPolicy(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo policy get <id>');
+            printError('Usage: hippo policy get <id>');
             process.exit(1);
         }
         const id = parsePositivePolicyId(idRaw);
         const p = policiesModule.loadPolicyById(hippoRoot, tenantId, id);
         if (!p) {
-            console.error(`Policy ${id} not found.`);
+            printError(`Policy ${id} not found.`);
             process.exit(1);
         }
         console.log(`Policy #${p.id}`);
@@ -4459,18 +4475,18 @@ function cmdPolicy(hippoRoot, args, flags) {
     if (subcommand === 'supersede') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo policy supersede <id> --text "<rule>" [--from <iso>] [--to <iso>] [--change "<summary>"]');
+            printError('Usage: hippo policy supersede <id> --text "<rule>" [--from <iso>] [--to <iso>] [--change "<summary>"]');
             process.exit(1);
         }
         const id = parsePositivePolicyId(idRaw);
         const textRaw = flags['text'];
         if (typeof textRaw !== 'string' || !textRaw.trim()) {
-            console.error('hippo policy supersede requires --text "<rule>" for the new version.');
+            printError('hippo policy supersede requires --text "<rule>" for the new version.');
             process.exit(1);
         }
         const existing = policiesModule.loadPolicyById(hippoRoot, tenantId, id);
         if (!existing) {
-            console.error(`Policy ${id} not found.`);
+            printError(`Policy ${id} not found.`);
             process.exit(1);
         }
         const fromRaw = flags['from'];
@@ -4491,7 +4507,7 @@ function cmdPolicy(hippoRoot, args, flags) {
                 console.log(`  memory: ${created.memoryId}`);
         }
         catch (e) {
-            console.error(e.message);
+            printError(e.message);
             process.exit(1);
         }
         return;
@@ -4499,7 +4515,7 @@ function cmdPolicy(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo policy close <id>');
+            printError('Usage: hippo policy close <id>');
             process.exit(1);
         }
         const id = parsePositivePolicyId(idRaw);
@@ -4512,12 +4528,12 @@ function cmdPolicy(hippoRoot, args, flags) {
     const policyName = subcommand === 'new' ? (args[1] ?? '') : subcommand;
     const textRaw = flags['text'];
     if (!policyName || typeof textRaw !== 'string' || !textRaw.trim()) {
-        console.error('Usage: hippo policy new "<name>" --text "<rule>" [--from <iso>] [--to <iso>]');
-        console.error('       hippo policy list [--status active|superseded|closed|all] [--limit N]');
-        console.error('       hippo policy get <id>');
-        console.error('       hippo policy asof <iso-date> [--name "<policy>"]');
-        console.error('       hippo policy supersede <id> --text "<rule>" [--from] [--to] [--change "<summary>"]');
-        console.error('       hippo policy close <id>');
+        printError('Usage: hippo policy new "<name>" --text "<rule>" [--from <iso>] [--to <iso>]');
+        printError('       hippo policy list [--status active|superseded|closed|all] [--limit N]');
+        printError('       hippo policy get <id>');
+        printError('       hippo policy asof <iso-date> [--name "<policy>"]');
+        printError('       hippo policy supersede <id> --text "<rule>" [--from] [--to] [--change "<summary>"]');
+        printError('       hippo policy close <id>');
         process.exit(1);
     }
     const fromRaw = flags['from'];
@@ -4536,7 +4552,7 @@ function cmdPolicy(hippoRoot, args, flags) {
             console.log(`  memory: ${created.memoryId}`);
     }
     catch (e) {
-        console.error(e.message);
+        printError(e.message);
         process.exit(1);
     }
 }
@@ -4546,7 +4562,7 @@ function parsePositiveSkillId(idRaw) {
     const s = String(idRaw ?? '').trim();
     const id = parseInt(s, 10);
     if (!/^\d+$/.test(s) || id <= 0) {
-        console.error(`Invalid skill id: "${idRaw}" (expected a positive integer).`);
+        printError(`Invalid skill id: "${idRaw}" (expected a positive integer).`);
         process.exit(1);
     }
     return id;
@@ -4568,7 +4584,7 @@ function cmdSkill(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         let results;
@@ -4577,7 +4593,7 @@ function cmdSkill(hippoRoot, args, flags) {
         }
         else {
             if (!skillsModule.VALID_SKILL_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
                 process.exit(1);
             }
             results = skillsModule.loadSkills(hippoRoot, tenantId, {
@@ -4606,13 +4622,13 @@ function cmdSkill(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo skill get <id>');
+            printError('Usage: hippo skill get <id>');
             process.exit(1);
         }
         const id = parsePositiveSkillId(idRaw);
         const s = skillsModule.loadSkillById(hippoRoot, tenantId, id);
         if (!s) {
-            console.error(`Skill ${id} not found.`);
+            printError(`Skill ${id} not found.`);
             process.exit(1);
         }
         console.log(`Skill #${s.id}`);
@@ -4638,18 +4654,18 @@ function cmdSkill(hippoRoot, args, flags) {
     if (subcommand === 'supersede') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo skill supersede <id> --instructions "<text>" [--trigger "<when>"] [--change "<summary>"]');
+            printError('Usage: hippo skill supersede <id> --instructions "<text>" [--trigger "<when>"] [--change "<summary>"]');
             process.exit(1);
         }
         const id = parsePositiveSkillId(idRaw);
         const instrRaw = flags['instructions'];
         if (typeof instrRaw !== 'string' || !instrRaw.trim()) {
-            console.error('hippo skill supersede requires --instructions "<text>" for the new version.');
+            printError('hippo skill supersede requires --instructions "<text>" for the new version.');
             process.exit(1);
         }
         const existing = skillsModule.loadSkillById(hippoRoot, tenantId, id);
         if (!existing) {
-            console.error(`Skill ${id} not found.`);
+            printError(`Skill ${id} not found.`);
             process.exit(1);
         }
         const trigRaw = flags['trigger'];
@@ -4668,7 +4684,7 @@ function cmdSkill(hippoRoot, args, flags) {
                 console.log(`  memory: ${created.memoryId}`);
         }
         catch (e) {
-            console.error(e.message);
+            printError(e.message);
             process.exit(1);
         }
         return;
@@ -4676,7 +4692,7 @@ function cmdSkill(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo skill close <id>');
+            printError('Usage: hippo skill close <id>');
             process.exit(1);
         }
         const id = parsePositiveSkillId(idRaw);
@@ -4689,12 +4705,12 @@ function cmdSkill(hippoRoot, args, flags) {
     const skillName = subcommand === 'new' ? (args[1] ?? '') : subcommand;
     const instrRaw = flags['instructions'];
     if (!skillName || typeof instrRaw !== 'string' || !instrRaw.trim()) {
-        console.error('Usage: hippo skill new "<name>" --instructions "<text>" [--trigger "<when>"]');
-        console.error('       hippo skill list [--status active|superseded|closed|all] [--limit N]');
-        console.error('       hippo skill get <id>');
-        console.error('       hippo skill export   (render active skills as an AGENTS.md/CLAUDE.md block)');
-        console.error('       hippo skill supersede <id> --instructions "<text>" [--trigger] [--change "<summary>"]');
-        console.error('       hippo skill close <id>');
+        printError('Usage: hippo skill new "<name>" --instructions "<text>" [--trigger "<when>"]');
+        printError('       hippo skill list [--status active|superseded|closed|all] [--limit N]');
+        printError('       hippo skill get <id>');
+        printError('       hippo skill export   (render active skills as an AGENTS.md/CLAUDE.md block)');
+        printError('       hippo skill supersede <id> --instructions "<text>" [--trigger] [--change "<summary>"]');
+        printError('       hippo skill close <id>');
         process.exit(1);
     }
     const trigRaw = flags['trigger'];
@@ -4710,7 +4726,7 @@ function cmdSkill(hippoRoot, args, flags) {
             console.log(`  memory: ${created.memoryId}`);
     }
     catch (e) {
-        console.error(e.message);
+        printError(e.message);
         process.exit(1);
     }
 }
@@ -4718,7 +4734,7 @@ function parsePositiveBriefId(idRaw) {
     const s = String(idRaw ?? '').trim();
     const id = parseInt(s, 10);
     if (!/^\d+$/.test(s) || id <= 0) {
-        console.error(`Invalid brief id: "${idRaw}" (expected a positive integer).`);
+        printError(`Invalid brief id: "${idRaw}" (expected a positive integer).`);
         process.exit(1);
     }
     return id;
@@ -4729,12 +4745,12 @@ function printBriefRow(b) {
         console.log(`    change: ${b.changeSummary}`);
 }
 function briefUsage() {
-    console.error('Usage: hippo brief new "<repo>" --summary "<text>"');
-    console.error('       hippo brief list [--status active|superseded|closed|all] [--repo "<repo>"] [--limit N]');
-    console.error('       hippo brief get <id>');
-    console.error('       hippo brief supersede <id> --summary "<text>" [--change "<summary>"]');
-    console.error('       hippo brief close <id>');
-    console.error('       hippo brief refresh "<repo>" [--dry-run]   (auto-assemble the brief from the repo\'s receipts)');
+    printError('Usage: hippo brief new "<repo>" --summary "<text>"');
+    printError('       hippo brief list [--status active|superseded|closed|all] [--repo "<repo>"] [--limit N]');
+    printError('       hippo brief get <id>');
+    printError('       hippo brief supersede <id> --summary "<text>" [--change "<summary>"]');
+    printError('       hippo brief close <id>');
+    printError('       hippo brief refresh "<repo>" [--dry-run]   (auto-assemble the brief from the repo\'s receipts)');
 }
 function cmdProjectBrief(hippoRoot, args, flags) {
     requireInit(hippoRoot);
@@ -4748,13 +4764,13 @@ function cmdProjectBrief(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         const opts = { limit, repo };
         if (status !== 'all') {
             if (!briefsModule.VALID_BRIEF_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
                 process.exit(1);
             }
             opts.status = status;
@@ -4772,14 +4788,14 @@ function cmdProjectBrief(hippoRoot, args, flags) {
     if (subcommand === 'refresh') {
         const repoRaw = args[1];
         if (!repoRaw) {
-            console.error('Usage: hippo brief refresh "<repo>" [--dry-run]');
+            printError('Usage: hippo brief refresh "<repo>" [--dry-run]');
             process.exit(1);
         }
         const dryRun = Boolean(flags['dry-run']);
         try {
             if (dryRun) {
                 const { markdown, receiptCount } = briefsModule.assembleBriefFromReceipts(hippoRoot, tenantId, repoRaw);
-                console.error(`(dry-run: assembled from ${receiptCount} receipt(s); brief NOT written)`);
+                printError(`(dry-run: assembled from ${receiptCount} receipt(s); brief NOT written)`);
                 console.log(markdown);
                 return;
             }
@@ -4791,7 +4807,7 @@ function cmdProjectBrief(hippoRoot, args, flags) {
                 console.log(`  memory: ${created.memoryId}`);
         }
         catch (e) {
-            console.error(e.message);
+            printError(e.message);
             process.exit(1);
         }
         return;
@@ -4799,13 +4815,13 @@ function cmdProjectBrief(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo brief get <id>');
+            printError('Usage: hippo brief get <id>');
             process.exit(1);
         }
         const id = parsePositiveBriefId(idRaw);
         const b = briefsModule.loadProjectBriefById(hippoRoot, tenantId, id);
         if (!b) {
-            console.error(`Project brief ${id} not found.`);
+            printError(`Project brief ${id} not found.`);
             process.exit(1);
         }
         console.log(`Project brief #${b.id}`);
@@ -4829,18 +4845,18 @@ function cmdProjectBrief(hippoRoot, args, flags) {
     if (subcommand === 'supersede') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo brief supersede <id> --summary "<text>" [--change "<summary>"]');
+            printError('Usage: hippo brief supersede <id> --summary "<text>" [--change "<summary>"]');
             process.exit(1);
         }
         const id = parsePositiveBriefId(idRaw);
         const summaryRaw = flags['summary'];
         if (typeof summaryRaw !== 'string' || !summaryRaw.trim()) {
-            console.error('hippo brief supersede requires --summary "<text>" for the new version.');
+            printError('hippo brief supersede requires --summary "<text>" for the new version.');
             process.exit(1);
         }
         const existing = briefsModule.loadProjectBriefById(hippoRoot, tenantId, id);
         if (!existing) {
-            console.error(`Project brief ${id} not found.`);
+            printError(`Project brief ${id} not found.`);
             process.exit(1);
         }
         const changeRaw = flags['change'];
@@ -4857,7 +4873,7 @@ function cmdProjectBrief(hippoRoot, args, flags) {
                 console.log(`  memory: ${created.memoryId}`);
         }
         catch (e) {
-            console.error(e.message);
+            printError(e.message);
             process.exit(1);
         }
         return;
@@ -4865,7 +4881,7 @@ function cmdProjectBrief(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo brief close <id>');
+            printError('Usage: hippo brief close <id>');
             process.exit(1);
         }
         const id = parsePositiveBriefId(idRaw);
@@ -4892,7 +4908,7 @@ function cmdProjectBrief(hippoRoot, args, flags) {
             console.log(`  memory: ${created.memoryId}`);
     }
     catch (e) {
-        console.error(e.message);
+        printError(e.message);
         process.exit(1);
     }
 }
@@ -4900,7 +4916,7 @@ function parsePositiveNoteId(idRaw) {
     const s = String(idRaw ?? '').trim();
     const id = parseInt(s, 10);
     if (!/^\d+$/.test(s) || id <= 0) {
-        console.error(`Invalid note id: "${idRaw}" (expected a positive integer).`);
+        printError(`Invalid note id: "${idRaw}" (expected a positive integer).`);
         process.exit(1);
     }
     return id;
@@ -4911,11 +4927,11 @@ function printNoteRow(n) {
         console.log(`    change: ${n.changeSummary}`);
 }
 function noteUsage() {
-    console.error('Usage: hippo note new "<customer>" --text "<note>"');
-    console.error('       hippo note list [--status active|superseded|closed|all] [--customer "<id>"] [--limit N]');
-    console.error('       hippo note get <id>');
-    console.error('       hippo note supersede <id> --text "<note>" [--change "<summary>"]');
-    console.error('       hippo note close <id>');
+    printError('Usage: hippo note new "<customer>" --text "<note>"');
+    printError('       hippo note list [--status active|superseded|closed|all] [--customer "<id>"] [--limit N]');
+    printError('       hippo note get <id>');
+    printError('       hippo note supersede <id> --text "<note>" [--change "<summary>"]');
+    printError('       hippo note close <id>');
 }
 function cmdGraph(hippoRoot, args, flags) {
     requireInit(hippoRoot);
@@ -4929,7 +4945,7 @@ function cmdGraph(hippoRoot, args, flags) {
         const supersedes = result.relations - result.references;
         console.log(`Graph extracted: ${result.entities} entities (${byType}) + ${result.relations} relations (${supersedes} supersedes, ${result.references} references).`);
         if (result.truncated.length > 0) {
-            console.error(`WARNING: under-extracted (hit the per-type cap): ${result.truncated.join(', ')}. The graph is incomplete for those types.`);
+            printError(`WARNING: under-extracted (hit the per-type cap): ${result.truncated.join(', ')}. The graph is incomplete for those types.`);
         }
         return;
     }
@@ -4968,7 +4984,7 @@ function cmdGraph(hippoRoot, args, flags) {
     if (subcommand === 'view') {
         const format = typeof flags['format'] === 'string' ? flags['format'] : 'html';
         if (format !== 'html' && format !== 'canvas') {
-            console.error("graph view: --format must be 'html' or 'canvas'");
+            printError("graph view: --format must be 'html' or 'canvas'");
             process.exit(1);
         }
         const model = buildGraphModel(hippoRoot, tenantId, { entity, limit: DEFAULT_VIEW_LIMIT });
@@ -4998,7 +5014,7 @@ function cmdGraph(hippoRoot, args, flags) {
         }
         return;
     }
-    console.error('Usage:\n' +
+    printError('Usage:\n' +
         '  hippo graph extract                     Rebuild the entity/relation graph from consolidated objects\n' +
         '  hippo graph show [--entity NAME] [--json]   Inspect entities + their edges (text or JSON)\n' +
         '  hippo graph view [--out FILE] [--open] [--format html|canvas] [--entity NAME]   Generate an interactive node-link diagram');
@@ -5016,13 +5032,13 @@ function cmdCustomerNote(hippoRoot, args, flags) {
         const limitRaw = flags['limit'];
         const limit = limitRaw !== undefined ? parseInt(String(limitRaw), 10) : 100;
         if (!Number.isFinite(limit) || limit <= 0) {
-            console.error(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
+            printError(`Invalid --limit: "${limitRaw}". Must be a positive integer.`);
             process.exit(1);
         }
         const opts = { limit, customer };
         if (status !== 'all') {
             if (!customerNotesModule.VALID_NOTE_STATES.has(status)) {
-                console.error(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
+                printError(`Invalid --status: "${status}". Must be one of: active | superseded | closed | all.`);
                 process.exit(1);
             }
             opts.status = status;
@@ -5040,13 +5056,13 @@ function cmdCustomerNote(hippoRoot, args, flags) {
     if (subcommand === 'get') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo note get <id>');
+            printError('Usage: hippo note get <id>');
             process.exit(1);
         }
         const id = parsePositiveNoteId(idRaw);
         const n = customerNotesModule.loadCustomerNoteById(hippoRoot, tenantId, id);
         if (!n) {
-            console.error(`Customer note ${id} not found.`);
+            printError(`Customer note ${id} not found.`);
             process.exit(1);
         }
         console.log(`Customer note #${n.id}`);
@@ -5070,18 +5086,18 @@ function cmdCustomerNote(hippoRoot, args, flags) {
     if (subcommand === 'supersede') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo note supersede <id> --text "<note>" [--change "<summary>"]');
+            printError('Usage: hippo note supersede <id> --text "<note>" [--change "<summary>"]');
             process.exit(1);
         }
         const id = parsePositiveNoteId(idRaw);
         const textRaw = flags['text'];
         if (typeof textRaw !== 'string' || !textRaw.trim()) {
-            console.error('hippo note supersede requires --text "<note>" for the new version.');
+            printError('hippo note supersede requires --text "<note>" for the new version.');
             process.exit(1);
         }
         const existing = customerNotesModule.loadCustomerNoteById(hippoRoot, tenantId, id);
         if (!existing) {
-            console.error(`Customer note ${id} not found.`);
+            printError(`Customer note ${id} not found.`);
             process.exit(1);
         }
         const changeRaw = flags['change'];
@@ -5098,7 +5114,7 @@ function cmdCustomerNote(hippoRoot, args, flags) {
                 console.log(`  memory: ${created.memoryId}`);
         }
         catch (e) {
-            console.error(e.message);
+            printError(e.message);
             process.exit(1);
         }
         return;
@@ -5106,7 +5122,7 @@ function cmdCustomerNote(hippoRoot, args, flags) {
     if (subcommand === 'close') {
         const idRaw = args[1];
         if (!idRaw) {
-            console.error('Usage: hippo note close <id>');
+            printError('Usage: hippo note close <id>');
             process.exit(1);
         }
         const id = parsePositiveNoteId(idRaw);
@@ -5133,7 +5149,7 @@ function cmdCustomerNote(hippoRoot, args, flags) {
             console.log(`  memory: ${created.memoryId}`);
     }
     catch (e) {
-        console.error(e.message);
+        printError(e.message);
         process.exit(1);
     }
 }
@@ -5188,9 +5204,21 @@ function cmdCurrent(hippoRoot, args, flags) {
         }
         return;
     }
-    console.error('Usage: hippo current <show>');
+    printError('Usage: hippo current <show>');
     process.exit(1);
 }
+/** Hook commands share one handle per store and wait at most HOOK_DB_WAIT_MS for a lock; a store still busy after that skips the hook's work with one warning, exit 0. */
+async function runHookWithStores(fn) {
+    try {
+        return await withSharedStoreHandles(fn, { busyWaitMs: HOOK_DB_WAIT_MS });
+    }
+    catch (error) {
+        if (!isSqliteBusy(error))
+            throw error;
+        noteStoreBusy('hook skipped');
+        return undefined;
+    }
+}
 async function cmdContext(hippoRoot, args, flags, stdinText) {
     const rec = startDeliveryRecorder(hippoRoot, flags, stdinText);
     // No try/finally: a render throw keeps its own exit code and writes no event.
@@ -5216,7 +5244,8 @@ function startDeliveryRecorder(hippoRoot, flags, stdinText) {
         });
     }
     catch (error) {
-        console.error(`[hippo] delivery ledger skipped: ${error instanceof Error ? error.message : String(error)}`);
+        // The hook's one-line stderr contract pins this exact text, so it bypasses the leveled logger.
+        printError(`[hippo] delivery ledger skipped:${error instanceof Error ? error.message : String(error)}`);
         return null;
     }
 }
@@ -5228,9 +5257,26 @@ function flushDeliveryRecorder(rec, db) {
         rec.flush((input) => (db ? writeDeliveryEventOnHandle(db, input) : writeDeliveryEventAtRoot(rec.root, input)));
     }
     catch (error) {
-        console.error(`[hippo] delivery ledger write failed: ${error instanceof Error ? error.message : String(error)}`);
+        // Pinned stderr text, as in the recorder build above.
+        printError(`[hippo] delivery ledger write failed:${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/**
+ * Whether this session sits in the pilot's holdout arm (src/pilot-arm.ts). Off at rate 0 and with no session id.
+ * `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash.
+ */
+function inPilotHoldout(hippoRoot, tenantId, sessionId, write) {
+    if (sessionId === undefined || sessionId.trim() === '')
+        return false;
+    const root = isInitialized(hippoRoot) ? hippoRoot : isInitialized(getGlobalRoot()) ? getGlobalRoot() : null;
+    if (root === null)
+        return false;
+    const rate = loadConfig(root).pilot.holdoutRateBp;
+    if (rate <= 0)
+        return false;
+    const arm = withLedgerDb(hippoRoot, (db) => write ? ensurePilotArm(db, tenantId, sessionId, rate) : readPilotArm(db, sessionId) ?? hashArm(sessionId, rate));
+    return (arm ?? hashArm(sessionId, rate)) === 'holdout';
+}
 async function renderContext(hippoRoot, args, flags, stdinText, rec) {
     // --pinned-only fires on every UserPromptSubmit — including in directories
     // that don't have a local .hippo. Skip requireInit for that path and fall
@@ -5240,30 +5286,6 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
     if (!pinnedOnly) {
         requireInit(hippoRoot);
     }
-    const budget = parseBudgetFlag(flags['budget'], 1500);
-    if (budget <= 0) {
-        rec?.disabled();
-        return;
-    }
-    // Resolve query: explicit args, --auto (git diff via CLI-side helper), or
-    // fall through to api.getContext's '*' fallback. api.getContext is host-
-    // agnostic so the auto-detect (which shells out to git) stays CLI-side.
-    let query = args.join(' ').trim();
-    if (!query && flags['auto']) {
-        query = autoDetectContext();
-    }
-    // Scope detection (CLI-side: uses cwd). api.getContext takes the resolved
-    // scope via opts.scope to stay host-agnostic.
-    const ctxExplicitScope = flags['scope'] !== undefined ? String(flags['scope']).trim() : null;
-    const ctxActiveScope = ctxExplicitScope || detectScope();
-    const ctx = {
-        hippoRoot,
-        tenantId: resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
-    // v39 memory scope isolation: --cross-project re-includes other-project
-    // memories (rendered under a demarcated section below).
-    const crossProject = flags['cross-project'] === true;
     // DF1 T2: resolve the calling session's id for the bounded active-task-
     // snapshot read (api.getContext -> loadFreshActiveTaskSnapshot). Stdin
     // payload (the UserPromptSubmit hook JSON) wins; falls back to
@@ -5291,6 +5313,36 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
     const ledgerSessionId = subagent ? undefined : currentSessionId;
     if (subagent)
         payloadSessionId = undefined;
+    // The pilot arm is booked at the first hook call whatever the flags, so the holdout sees no budget or content branch.
+    const resolvedTenant = resolveTenantId({});
+    if (inPilotHoldout(hippoRoot, resolvedTenant, currentSessionId, payloadSessionId !== undefined)) {
+        rec?.disabled();
+        return;
+    }
+    const budget = parseBudgetFlag(flags['budget'], 1500);
+    if (budget <= 0) {
+        rec?.disabled();
+        return;
+    }
+    // Resolve query: explicit args, --auto (git diff via CLI-side helper), or
+    // fall through to api.getContext's '*' fallback. api.getContext is host-
+    // agnostic so the auto-detect (which shells out to git) stays CLI-side.
+    let query = args.join(' ').trim();
+    if (!query && flags['auto']) {
+        query = autoDetectContext();
+    }
+    // Scope detection (CLI-side: uses cwd). api.getContext takes the resolved
+    // scope via opts.scope to stay host-agnostic.
+    const ctxExplicitScope = flags['scope'] !== undefined ? String(flags['scope']).trim() : null;
+    const ctxActiveScope = ctxExplicitScope || detectScope();
+    const ctx = {
+        hippoRoot,
+        tenantId: resolvedTenant,
+        actor: api.adminActor('cli'),
+    };
+    // v39 memory scope isolation: --cross-project re-includes other-project
+    // memories (rendered under a demarcated section below).
+    const crossProject = flags['cross-project'] === true;
     const format = String(flags['format'] ?? 'markdown');
     const framing = String(flags['framing'] ?? 'observe');
     const opts = {
@@ -5447,8 +5499,12 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
                             tenantId: ctx.tenantId, sessionId: ledgerSessionId, surface, event: 'inject',
                             items: staticItems.length, tokens: estimateTokens(finalStatic), hash: blockHash(finalStatic),
                         });
+                        // Best-effort row: only a busy store is actionable, and a ledger failure must not break the hook.
+                    }
+                    catch (error) {
+                        if (isSqliteBusy(error))
+                            noteStoreBusy('token ledger row skipped');
                     }
-                    catch { /* best effort; see withLedgerDb doc comment */ }
                 }
                 if (recallBlock) {
                     try {
@@ -5456,8 +5512,12 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
                             tenantId: ctx.tenantId, sessionId: ledgerSessionId, surface: 'hook_recall', event: 'inject',
                             items: recallItems.length, tokens: estimateTokens(recallBlock), hash: blockHash(recallBlock),
                         });
+                        // Same best-effort rule as the inject row above.
+                    }
+                    catch (error) {
+                        if (isSqliteBusy(error))
+                            noteStoreBusy('token ledger row skipped');
                     }
-                    catch { /* best effort; see withLedgerDb doc comment */ }
                 }
                 flushDeliveryRecorder(rec, db);
             });
@@ -5560,7 +5620,7 @@ async function cmdEmbed(hippoRoot, flags) {
             return resolveEmbeddingProvider(root);
         }
         catch (err) {
-            console.error(err instanceof Error ? err.message : String(err));
+            printError(err instanceof Error ? err.message : String(err));
             return null;
         }
     })();
@@ -5578,8 +5638,8 @@ async function cmdEmbed(hippoRoot, flags) {
             console.log('  npm install @huggingface/transformers');
         }
         else {
-            console.error(`Embedding provider '${embedProvider.kind}' is configured but ${embedProvider.keyEnv} is not set.`);
-            console.error(`Export ${embedProvider.keyEnv}, or set config.embeddings.provider back to 'local'.`);
+            printError(`Embedding provider '${embedProvider.kind}' is configured but ${embedProvider.keyEnv} is not set.`);
+            printError(`Export ${embedProvider.keyEnv}, or set config.embeddings.provider back to 'local'.`);
             process.exitCode = 1;
         }
         return;
@@ -5590,9 +5650,9 @@ async function cmdEmbed(hippoRoot, flags) {
         count = await embedAll(root, resolveEmbeddingModel(root));
     }
     catch (err) {
-        console.error(`Embedding failed: ${err instanceof Error ? err.message : String(err)}`);
+        printError(`Embedding failed: ${err instanceof Error ? err.message : String(err)}`);
         const partial = loadEmbeddingIndex(root);
-        console.error(`Partial progress saved: ${Object.keys(partial).length} embeddings on disk. Re-run \`hippo embed\` to resume.`);
+        printError(`Partial progress saved: ${Object.keys(partial).length} embeddings on disk. Re-run \`hippo embed\` to resume.`);
         process.exitCode = 1;
         return;
     }
@@ -5605,7 +5665,7 @@ async function cmdEmbed(hippoRoot, flags) {
 // ---------------------------------------------------------------------------
 async function cmdWatch(command, hippoRoot) {
     if (!command) {
-        console.error('Usage: hippo watch "<command>"');
+        printError('Usage: hippo watch "<command>"');
         process.exit(1);
     }
     const { exitCode, stderr } = await runWatched(command);
@@ -5615,7 +5675,7 @@ async function cmdWatch(command, hippoRoot) {
     }
     // Only create memory if hippo is initialized
     if (!isInitialized(hippoRoot)) {
-        console.error('Command failed but .hippo not initialized. Run `hippo init` to enable auto-learn.');
+        printError('Command failed but .hippo not initialized. Run `hippo init` to enable auto-learn.');
         process.exit(exitCode);
     }
     const entry = captureError(exitCode, stderr, command, resolveTenantId({}));
@@ -5634,11 +5694,11 @@ async function cmdWatch(command, hippoRoot) {
         updateStats(hippoRoot, { remembered: 1 });
         void embedMemory(hippoRoot, entry);
         const preview = stderr.trim().slice(0, 80);
-        console.error(`\nHippo learned from failure: "${preview}"`);
+        printError(`\nHippo learned from failure: "${preview}"`);
     }
     catch (err) {
         if (err instanceof RejectedValueError) {
-            console.error(`\nHippo: this failure matches a rejected value (${err.reason ?? 'no reason given'}); not stored.`);
+            printError(`\nHippo: this failure matches a rejected value (${err.reason ?? 'no reason given'}); not stored.`);
         }
         else {
             throw err;
@@ -5652,7 +5712,7 @@ async function cmdWatch(command, hippoRoot) {
 function cmdLearn(hippoRoot, flags) {
     requireInit(hippoRoot);
     if (!flags['git']) {
-        console.error('Usage: hippo learn --git [--days <n>] [--repos <paths>]');
+        printError('Usage: hippo learn --git [--days <n>] [--repos <paths>]');
         process.exit(1);
     }
     const days = parseInt(String(flags['days'] ?? '7'), 10);
@@ -5678,6 +5738,10 @@ function cmdLearn(hippoRoot, flags) {
 // ---------------------------------------------------------------------------
 // Import command
 // ---------------------------------------------------------------------------
+function warnRedacted(count) {
+    if (count)
+        printError(`Warning: secret-shaped text was redacted from ${count} imported ${count === 1 ? 'entry' : 'entries'} before storing`);
+}
 function cmdImport(hippoRoot, args, flags) {
     const useGlobal = Boolean(flags['global']);
     const dryRun = Boolean(flags['dry-run']);
@@ -5696,7 +5760,7 @@ function cmdImport(hippoRoot, args, flags) {
         for (const line of detailLines(report, dryRun))
             console.log(line);
         for (const warning of report.warnings)
-            console.error(`hippo: agent memories: ${warning}`);
+            printError(`hippo: agent memories: ${warning}`);
         return;
     }
     if (useGlobal) {
@@ -5720,11 +5784,11 @@ function cmdImport(hippoRoot, args, flags) {
     if (flags['vault']) {
         const folderPath = String(flags['vault']);
         if (!fs.existsSync(folderPath) || !fs.statSync(folderPath).isDirectory()) {
-            console.error(`Vault folder not found (or not a directory): ${folderPath}`);
+            printError(`Vault folder not found (or not a directory): ${folderPath}`);
             process.exit(1);
         }
         if (useGlobal) {
-            console.error('hippo import --vault does not support --global (raw rows are tenant-local).');
+            printError('hippo import --vault does not support --global (raw rows are tenant-local).');
             process.exit(1);
         }
         if (typeof flags['name'] !== 'string' || !flags['name'].trim()) {
@@ -5733,14 +5797,14 @@ function cmdImport(hippoRoot, args, flags) {
             // clobber each other (codex R10 P2). A valueless `--name` parses as boolean
             // true, and String(true) === "true" would silently import under vault:true:*
             // - reject a non-string so it fails fast instead (codex R11 P2).
-            console.error('hippo import --vault requires --name <vault> (a non-empty identity key for source-deletion sync).');
+            printError('hippo import --vault requires --name <vault> (a non-empty identity key for source-deletion sync).');
             process.exit(1);
         }
         if (flags['scope'] !== undefined && (typeof flags['scope'] !== 'string' || !flags['scope'].trim())) {
             // Same valueless-flag trap: a bare `--scope` must not become scope "true".
             // Example uses the source-prefixed private form, since a bare `private` scope
             // is NOT treated as private by recall and importVault rejects it (R13 P2).
-            console.error('hippo import --vault: --scope requires a value (e.g. --scope vault:private:notes).');
+            printError('hippo import --vault: --scope requires a value (e.g. --scope vault:private:notes).');
             process.exit(1);
         }
         const tenantId = resolveTenantId({});
@@ -5758,6 +5822,7 @@ function cmdImport(hippoRoot, args, flags) {
         if ((vaultResult.rejected ?? 0) > 0) {
             console.log(`  Rejected (tombstoned): ${vaultResult.rejected}`);
         }
+        warnRedacted(vaultResult.redacted);
         console.log(`  ${dryRun ? 'Would archive:        ' : 'Archived (removed):   '}${vaultResult.archived ?? 0}`);
         console.log(`  Store:                 ${hippoRoot}`);
         // Batch producer, same contract as the single-file import below: vault rows
@@ -5804,11 +5869,11 @@ function cmdImport(hippoRoot, args, flags) {
         importerName = 'File';
     }
     if (!filePath || !importer) {
-        console.error('Usage: hippo import <--chatgpt|--claude|--cursor|--file|--markdown|--vault> <path>, or hippo import --agents [--dry-run]');
+        printError('Usage: hippo import <--chatgpt|--claude|--cursor|--file|--markdown|--vault> <path>, or hippo import --agents [--dry-run]');
         process.exit(1);
     }
     if (!fs.existsSync(filePath)) {
-        console.error(`File not found: ${filePath}`);
+        printError(`File not found: ${filePath}`);
         process.exit(1);
     }
     const result = importer(filePath, importOptions);
@@ -5829,6 +5894,7 @@ function cmdImport(hippoRoot, args, flags) {
     if ((result.rejected ?? 0) > 0) {
         console.log(`  Rejected (tombstoned): ${result.rejected}`);
     }
+    warnRedacted(result.redacted);
     if (dryRun) {
         console.log('\n  (dry run - nothing written)');
         if (result.entries.length > 0) {
@@ -5851,7 +5917,7 @@ function cmdImport(hippoRoot, args, flags) {
 function cmdPromote(hippoRoot, id) {
     requireInit(hippoRoot);
     if (!id) {
-        console.error('Usage: hippo promote <id>');
+        printError('Usage: hippo promote <id>');
         process.exit(1);
     }
     const ctx = {
@@ -5865,7 +5931,7 @@ function cmdPromote(hippoRoot, id) {
         console.log(`   Global store: ${getGlobalRoot()}`);
     }
     catch (err) {
-        console.error(`Failed to promote: ${err.message}`);
+        printError(`Failed to promote: ${err.message}`);
         process.exit(1);
     }
 }
@@ -5903,8 +5969,8 @@ function cmdHook(args, flags) {
     }
     if (subcommand === 'install') {
         if (!target || !HOOKS[target]) {
-            console.error(`Unknown hook target: ${target ?? '(none)'}`);
-            console.error(`   Available: ${Object.keys(HOOKS).join(', ')}`);
+            printError(`Unknown hook target: ${target ?? '(none)'}`);
+            printError(`   Available: ${Object.keys(HOOKS).join(', ')}`);
             process.exit(1);
         }
         const hook = HOOKS[target];
@@ -6004,7 +6070,7 @@ function cmdHook(args, flags) {
     }
     if (subcommand === 'uninstall') {
         if (!target || !HOOKS[target]) {
-            console.error(`Unknown hook target: ${target ?? '(none)'}`);
+            printError(`Unknown hook target: ${target ?? '(none)'}`);
             process.exit(1);
         }
         const hook = HOOKS[target];
@@ -6064,7 +6130,7 @@ function cmdHook(args, flags) {
         }
         return;
     }
-    console.error('Usage: hippo hook <install|uninstall|list> [target]');
+    printError('Usage: hippo hook <install|uninstall|list> [target]');
     process.exit(1);
 }
 function withoutHookBlock(text) {
@@ -6211,7 +6277,7 @@ function cmdDailyRunner() {
     const globalRoot = getGlobalRoot();
     // No workspace sleep ever opens the global store, yet hooks in folders without a store compact into it.
     if (isInitialized(globalRoot)) {
-        const finished = replayCompactionsAt(globalRoot, (message) => console.error(`compaction replay: ${message}`));
+        const finished = replayCompactionsAt(globalRoot, (message) => log.warn(`compaction replay: ${message}`));
         if (finished > 0)
             console.log(`Finished saving ${finished} compaction${finished === 1 ? '' : 's'} left over in the global store.`);
     }
@@ -6237,7 +6303,7 @@ function cmdDailyRunner() {
         catch (err) {
             failed++;
             const action = args.join(' ');
-            console.error(`[hippo] daily-runner failed in ${cwd} during \`${action}\`: ${err.message}`);
+            log.error(`daily-runner failed in ${cwd} during \`${action}\`: ${err.message}`);
         }
     });
     console.log(`Daily maintenance complete: ${processed} workspace${processed === 1 ? '' : 's'} processed, ${failed} command failure${failed === 1 ? '' : 's'}.`);
@@ -6255,7 +6321,7 @@ function cmdWm(hippoRoot, args, flags) {
         const sessionId = flags['session'] ? String(flags['session']).trim() : undefined;
         const taskId = flags['task'] ? String(flags['task']).trim() : undefined;
         if (!content) {
-            console.error('Usage: hippo wm push --scope <scope> --content "..." [--importance 0.8] [--session <id>] [--task <id>]');
+            printError('Usage: hippo wm push --scope <scope> --content "..." [--importance 0.8] [--session <id>] [--task <id>]');
             process.exit(1);
         }
         const id = wmPush(hippoRoot, {
@@ -6306,7 +6372,7 @@ function cmdWm(hippoRoot, args, flags) {
         console.log(`Flushed ${count} working memory entries.`);
         return;
     }
-    console.error('Usage: hippo wm <push|read|clear|flush>');
+    printError('Usage: hippo wm <push|read|clear|flush>');
     process.exit(1);
 }
 function cmdDag(hippoRoot, flags) {
@@ -6423,7 +6489,7 @@ function cmdDrillDown(hippoRoot, summaryId, flags) {
     let depth;
     if (rawDepth !== undefined) {
         if (!Number.isInteger(rawDepth) || rawDepth < 1 || rawDepth > 10) {
-            console.error(`--depth must be an integer between 1 and 10 (got ${flags['depth']})`);
+            printError(`--depth must be an integer between 1 and 10 (got ${flags['depth']})`);
             process.exit(2);
         }
         depth = rawDepth;
@@ -6444,10 +6510,10 @@ function cmdDrillDown(hippoRoot, summaryId, flags) {
         // intentionally collapses cross-tenant + scope-blocked + missing
         // (codex round 3 P1: distinguishing scope_blocked leaked existence).
         if (r.failure === 'not_drillable') {
-            console.error(`Id ${summaryId} is a leaf row, not a level-2+ summary; nothing to drill into.`);
+            printError(`Id ${summaryId} is a leaf row, not a level-2+ summary; nothing to drill into.`);
         }
         else {
-            console.error(`No drillable summary at id=${summaryId}.`);
+            printError(`No drillable summary at id=${summaryId}.`);
         }
         process.exit(1);
     }
@@ -6477,7 +6543,7 @@ function cmdAuthCreate(hippoRoot, flags) {
     let role = 'admin';
     if (roleFlag !== undefined) {
         if (roleFlag !== 'admin' && roleFlag !== 'member') {
-            console.error(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
+            printError(`Invalid --role value: '${roleFlag}'. Use 'admin' or 'member'.`);
             process.exit(1);
         }
         role = roleFlag;
@@ -6556,7 +6622,7 @@ function cmdAuthRevoke(hippoRoot, keyId, flags) {
         closeHippoDb(db);
     }
     if (keyTenant === undefined) {
-        console.error(`Unknown key_id: ${keyId}`);
+        printError(`Unknown key_id: ${keyId}`);
         process.exit(1);
     }
     const ctx = { hippoRoot: root, tenantId: keyTenant, actor: api.adminActor('cli') };
@@ -6565,7 +6631,7 @@ function cmdAuthRevoke(hippoRoot, keyId, flags) {
         revokedAt = api.authRevoke(ctx, keyId).revokedAt;
     }
     catch (err) {
-        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        printError(`Error: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
     if (flags['json']) {
@@ -6589,7 +6655,7 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
         closeHippoDb(db);
     }
     if (keyTenant === undefined) {
-        console.error(`Unknown key_id: ${keyId}`);
+        printError(`Unknown key_id: ${keyId}`);
         process.exit(1);
     }
     const ctx = { hippoRoot: root, tenantId: keyTenant, actor: api.adminActor('cli') };
@@ -6600,7 +6666,7 @@ function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
             api.authUngrant(ctx, keyId, scope);
     }
     catch (err) {
-        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        printError(`Error: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
     if (flags['json']) {
@@ -6627,13 +6693,13 @@ function cmdAuditList(hippoRoot, flags) {
         // Regenerate from Set to prevent future drift (v1.11.5: pre-v1.11.5 message
         // was hand-maintained and had drifted — missed 'auth_revoke' and 'outcome').
         const expected = Array.from(VALID_AUDIT_OPS).join(' | ');
-        console.error(`Unknown --op value: ${opFlag}. Expected one of: ${expected}.`);
+        printError(`Unknown --op value: ${opFlag}. Expected one of: ${expected}.`);
         process.exit(1);
     }
     const op = opFlag;
     const since = typeof flags['since'] === 'string' ? flags['since'] : undefined;
     if (since !== undefined && !Number.isFinite(new Date(since).getTime())) {
-        console.error(`Invalid --since: ${since} (expected an ISO timestamp like 2026-04-22 or 2026-04-22T12:00:00Z).`);
+        printError(`Invalid --since: ${since} (expected an ISO timestamp like 2026-04-22 or 2026-04-22T12:00:00Z).`);
         process.exit(1);
     }
     const limitRaw = flags['limit'];
@@ -6641,13 +6707,13 @@ function cmdAuditList(hippoRoot, flags) {
     if (limitRaw !== undefined && typeof limitRaw !== 'boolean') {
         const parsed = parseInt(String(limitRaw), 10);
         if (!Number.isFinite(parsed)) {
-            console.error(`Invalid --limit value: ${String(limitRaw)} (expected a positive integer).`);
+            printError(`Invalid --limit value: ${String(limitRaw)} (expected a positive integer).`);
             process.exit(1);
         }
         limit = parsed;
     }
     if (limit < 1 || limit > 10000) {
-        console.error(`--limit must be between 1 and 10000 (got ${limit}).`);
+        printError(`--limit must be between 1 and 10000 (got ${limit}).`);
         process.exit(1);
     }
     const ctx = { hippoRoot: root, tenantId, actor: { subject: 'cli', role: 'admin' } };
@@ -6675,7 +6741,7 @@ function printAuditPruneUsage() {
 function cmdAuditPrune(hippoRoot, flags) {
     const olderThanRaw = typeof flags['older-than'] === 'string' ? flags['older-than'] : '';
     if (!olderThanRaw) {
-        console.error('Usage: hippo audit prune --older-than <Nd> [--dry-run] [--tenant <t>]');
+        printError('Usage: hippo audit prune --older-than <Nd> [--dry-run] [--tenant <t>]');
         process.exit(1);
     }
     let olderThanDays;
@@ -6683,7 +6749,7 @@ function cmdAuditPrune(hippoRoot, flags) {
         olderThanDays = parseOlderThanFlag(olderThanRaw);
     }
     catch (e) {
-        console.error(e.message);
+        printError(e.message);
         process.exit(1);
     }
     const tenantId = typeof flags['tenant'] === 'string'
@@ -6719,7 +6785,7 @@ function cmdAuditLog(hippoRoot, args, flags) {
         cmdAuditPrune(hippoRoot, flags);
         return;
     }
-    console.error(`Unknown audit subcommand: ${sub}. Expected: list | prune.`);
+    printError(`Unknown audit subcommand: ${sub}. Expected: list | prune.`);
     process.exit(1);
 }
 // ---------------------------------------------------------------------------
@@ -6740,7 +6806,7 @@ function resolveGoalSession(flags) {
         ? String(flags['session-id'])
         : process.env.HIPPO_SESSION_ID ?? '').trim();
     if (!sessionId) {
-        console.error('session id required (set HIPPO_SESSION_ID or pass --session-id)');
+        printError('session id required (set HIPPO_SESSION_ID or pass --session-id)');
         process.exit(1);
     }
     const tenantId = (flags['tenant-id'] !== undefined
@@ -6751,51 +6817,51 @@ function resolveGoalSession(flags) {
 function cmdGoalPush(hippoRoot, args, flags) {
     const rawName = args.join(' ').trim();
     if (!rawName) {
-        console.error('Usage: hippo goal push <name> [--policy <type>] [--success "<condition>"] [--level N] [--parent <goalId>]');
+        printError('Usage: hippo goal push <name> [--policy <type>] [--success "<condition>"] [--level N] [--parent <goalId>]');
         process.exit(1);
     }
     // Sanitize at WRITE time so corrupt names never enter the DB.
     const name = sanitizeGoalName(rawName);
     if (name !== rawName) {
-        console.error('note: stripped control characters from goal name');
+        printError('note: stripped control characters from goal name');
     }
     const { sessionId, tenantId } = resolveGoalSession(flags);
     let policy;
     const policyRaw = flags['policy'];
     if (policyRaw === true) {
-        console.error('--policy requires a value (e.g., --policy error-prioritized)');
+        printError('--policy requires a value (e.g., --policy error-prioritized)');
         process.exit(1);
     }
     if (typeof policyRaw === 'string') {
         if (!GOAL_POLICY_TYPES.includes(policyRaw)) {
-            console.error(`Unknown --policy '${policyRaw}'. Expected one of: ${GOAL_POLICY_TYPES.join(' | ')}.`);
+            printError(`Unknown --policy '${policyRaw}'. Expected one of: ${GOAL_POLICY_TYPES.join(' | ')}.`);
             process.exit(1);
         }
         policy = { policyType: policyRaw };
     }
     const successRaw = flags['success'];
     if (successRaw === true) {
-        console.error('--success requires a value (e.g., --success "<condition>")');
+        printError('--success requires a value (e.g., --success "<condition>")');
         process.exit(1);
     }
     const successCondition = typeof successRaw === 'string' ? successRaw : undefined;
     const levelRaw = flags['level'];
     let level;
     if (levelRaw === true) {
-        console.error('--level requires a value (e.g., --level 1)');
+        printError('--level requires a value (e.g., --level 1)');
         process.exit(1);
     }
     if (levelRaw !== undefined) {
         const parsed = Number(levelRaw);
         if (!Number.isFinite(parsed) || parsed < 0 || parsed > 2 || !Number.isInteger(parsed)) {
-            console.error('--level must be an integer in [0, 2]');
+            printError('--level must be an integer in [0, 2]');
             process.exit(1);
         }
         level = parsed;
     }
     const parentRaw = flags['parent'];
     if (parentRaw === true) {
-        console.error('--parent requires a value (e.g., --parent <goalId>)');
+        printError('--parent requires a value (e.g., --parent <goalId>)');
         process.exit(1);
     }
     const parentGoalId = typeof parentRaw === 'string' ? parentRaw : undefined;
@@ -6861,19 +6927,19 @@ function cmdGoalList(hippoRoot, flags) {
 function cmdGoalComplete(hippoRoot, args, flags) {
     const id = args[0];
     if (!id) {
-        console.error('Usage: hippo goal complete <id> [--outcome <0..1>] [--no-propagate]');
+        printError('Usage: hippo goal complete <id> [--outcome <0..1>] [--no-propagate]');
         process.exit(1);
     }
     let outcomeScore;
     const outcomeRaw = flags['outcome'];
     if (outcomeRaw === true) {
-        console.error('--outcome requires a value (e.g., --outcome 0.9)');
+        printError('--outcome requires a value (e.g., --outcome 0.9)');
         process.exit(1);
     }
     if (outcomeRaw !== undefined) {
         const parsed = Number(outcomeRaw);
         if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {
-            console.error('--outcome must be a number in [0, 1]');
+            printError('--outcome must be a number in [0, 1]');
             process.exit(1);
         }
         outcomeScore = parsed;
@@ -6885,7 +6951,7 @@ function cmdGoalComplete(hippoRoot, args, flags) {
 function cmdGoalSuspend(hippoRoot, args) {
     const id = args[0];
     if (!id) {
-        console.error('Usage: hippo goal suspend <id>');
+        printError('Usage: hippo goal suspend <id>');
         process.exit(1);
     }
     suspendGoal(hippoRoot, id);
@@ -6894,7 +6960,7 @@ function cmdGoalSuspend(hippoRoot, args) {
 function cmdGoalResume(hippoRoot, args) {
     const id = args[0];
     if (!id) {
-        console.error('Usage: hippo goal resume <id>');
+        printError('Usage: hippo goal resume <id>');
         process.exit(1);
     }
     resumeGoal(hippoRoot, id);
@@ -6903,7 +6969,7 @@ function cmdGoalResume(hippoRoot, args) {
 function cmdGoal(hippoRoot, args, flags) {
     const sub = args[0];
     if (!sub) {
-        console.error('Usage: hippo goal <push|list|complete|suspend|resume> [args]');
+        printError('Usage: hippo goal <push|list|complete|suspend|resume> [args]');
         process.exit(1);
     }
     const subArgs = args.slice(1);
@@ -6924,14 +6990,14 @@ function cmdGoal(hippoRoot, args, flags) {
             cmdGoalResume(hippoRoot, subArgs);
             return;
         default:
-            console.error(`Unknown goal subcommand: ${sub}. Expected: push | list | complete | suspend | resume.`);
+            printError(`Unknown goal subcommand: ${sub}. Expected: push | list | complete | suspend | resume.`);
             process.exit(1);
     }
 }
 function cmdAuth(hippoRoot, args, flags) {
     const sub = args[0];
     if (!sub) {
-        console.error('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
+        printError('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
         process.exit(1);
     }
     const subArgs = args.slice(1);
@@ -6945,7 +7011,7 @@ function cmdAuth(hippoRoot, args, flags) {
         case 'revoke': {
             const keyId = subArgs[0];
             if (!keyId) {
-                console.error('Usage: hippo auth revoke <key_id>');
+                printError('Usage: hippo auth revoke <key_id>');
                 process.exit(1);
             }
             cmdAuthRevoke(hippoRoot, keyId, flags);
@@ -6955,14 +7021,14 @@ function cmdAuth(hippoRoot, args, flags) {
         case 'ungrant': {
             const [keyId, scope] = subArgs;
             if (!keyId || !scope) {
-                console.error(`Usage: hippo auth ${sub} <key_id> <scope>`);
+                printError(`Usage: hippo auth ${sub} <key_id> <scope>`);
                 process.exit(1);
             }
             cmdAuthScopeGrant(hippoRoot, keyId, scope, sub === 'grant', flags);
             return;
         }
         default:
-            console.error(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke | grant | ungrant.`);
+            printError(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke | grant | ungrant.`);
             process.exit(1);
     }
 }
@@ -6983,7 +7049,7 @@ function cmdSlackBackfill(hippoRoot, flags) {
     // Real fetcher requires SLACK_BOT_TOKEN with channels:history scope.
     const token = process.env.SLACK_BOT_TOKEN;
     if (!token) {
-        console.error('SLACK_BOT_TOKEN is not set. Backfill requires a Slack bot token with channels:history scope.');
+        printError('SLACK_BOT_TOKEN is not set. Backfill requires a Slack bot token with channels:history scope.');
         process.exit(2);
     }
     // --since is advisory in V1: the slack_cursors row drives resume, so the
@@ -7006,7 +7072,7 @@ function cmdSlackBackfill(hippoRoot, flags) {
         console.log(`backfill ${channel}: ${r.ingested} new messages across ${r.pages} pages`);
     })
         .catch((e) => {
-        console.error('backfill failed:', e.message);
+        printError('backfill failed:', e.message);
         process.exit(3);
     });
 }
@@ -7026,12 +7092,12 @@ function cmdSlackDlqList(hippoRoot, _flags) {
 function cmdSlackDlqReplay(hippoRoot, args, flags) {
     const idArg = args[2];
     if (!idArg) {
-        console.error('Usage: hippo slack dlq replay <id> [--force]');
+        printError('Usage: hippo slack dlq replay <id> [--force]');
         process.exit(1);
     }
     const id = Number(idArg);
     if (!Number.isFinite(id) || !Number.isInteger(id) || id < 1) {
-        console.error(`replay: invalid id ${idArg}`);
+        printError(`replay: invalid id ${idArg}`);
         process.exit(1);
     }
     const force = flags.force === true;
@@ -7040,7 +7106,7 @@ function cmdSlackDlqReplay(hippoRoot, args, flags) {
         signingSecret: process.env.SLACK_SIGNING_SECRET,
     });
     if (!result.ok) {
-        console.error(`replay failed: status=${result.status} retry_count=${result.retryCount}${result.reason ? ` reason=${result.reason}` : ''}`);
+        printError(`replay failed: status=${result.status} retry_count=${result.retryCount}${result.reason ? ` reason=${result.reason}` : ''}`);
         process.exit(1);
     }
     console.log(`replay ok: status=${result.status} memory_id=${result.memoryId ?? '(none)'} retry_count=${result.retryCount}`);
@@ -7055,7 +7121,7 @@ function cmdSlackWorkspacesAdd(hippoRoot, flags) {
     const teamId = typeof flags['team'] === 'string' ? flags['team'].trim() : '';
     const tenantId = typeof flags['tenant'] === 'string' ? flags['tenant'].trim() : '';
     if (!teamId || !tenantId) {
-        console.error('Usage: hippo slack workspaces add --team <T> --tenant <t>');
+        printError('Usage: hippo slack workspaces add --team <T> --tenant <t>');
         process.exit(1);
     }
     const db = openHippoDb(hippoRoot);
@@ -7086,14 +7152,14 @@ function cmdSlackWorkspacesList(hippoRoot) {
 function cmdSlackWorkspacesRemove(hippoRoot, flags) {
     const teamId = typeof flags['team'] === 'string' ? flags['team'].trim() : '';
     if (!teamId) {
-        console.error('Usage: hippo slack workspaces remove --team <T>');
+        printError('Usage: hippo slack workspaces remove --team <T>');
         process.exit(1);
     }
     const db = openHippoDb(hippoRoot);
     try {
         const removed = removeSlackWorkspace(db, teamId);
         if (!removed) {
-            console.error(`no workspace registered for team ${teamId}`);
+            printError(`no workspace registered for team ${teamId}`);
             process.exit(1);
         }
         console.log(`removed: ${teamId}`);
@@ -7133,7 +7199,7 @@ function cmdSlack(hippoRoot, args, flags) {
         printSlackWorkspacesUsage();
         process.exit(1);
     }
-    console.error('Usage: hippo slack <backfill|dlq list|dlq replay <id> [--force]|workspaces add|workspaces list|workspaces remove> [...]');
+    printError('Usage: hippo slack <backfill|dlq list|dlq replay <id> [--force]|workspaces add|workspaces list|workspaces remove> [...]');
     process.exit(1);
 }
 export function usageText() {
@@ -7207,17 +7273,21 @@ Commands:
                            where cost_factor = min(0.3, tokens / 10000). Re-sorts
                            results by utility. Default off. RESEARCH.md §PFC.OFC.
     --reranker <name>      Apply a reranker pass after retrieval
-                           (cross-encoder|jev|llm). Looks up the named
-                           reranker from src/rerankers/index.ts and re-orders
-                           the top-K candidates. Default unset (no reranker).
+                           (cross-encoder|jev|clef-flash|clef|llm). Looks up
+                           the named reranker from src/rerankers/index.ts and
+                           re-orders the top-K candidates. Default unset (no reranker).
                            jev calls the hosted TypeSafe Jev API: it needs
                            TYPESAFE_API_KEY, sends the query and candidate
                            text to that API, costs about 0.0004 USD a recall,
                            and falls back to cross-encoder on any failure.
+                           clef-flash and clef send the same request to
+                           Cloudflare Workers AI (CLOUDFLARE_ACCOUNT_ID and
+                           CLOUDFLARE_API_TOKEN) or to HIPPO_CLEF_ENDPOINT, and
+                           keep the native order on any failure.
                            See docs/evals/2026-09-19-jev-reranker.md and
                            docs/plans/2026-05-10-f6-reranker-hardening.md.
     --reranker-top-k <n>   Cap candidates passed to the reranker (default 50;
-                           40 for jev).
+                           40 for jev, clef-flash and clef).
     --goal <tag>           dlPFC goal-conditioned recall: memories tagged with
                            the goal tag get a 1.5x score boost and results are
                            re-sorted. Default off. RESEARCH.md §PFC.dlPFC.
@@ -7356,7 +7426,16 @@ Commands:
     --global               Operate on the global store
     dormant restore <id>   Bring a dormant memory back to active memory
     dormant forget <id>    Delete a dormant memory permanently
-  quarantine [list]        List memories a connector flagged as an instruction attempt, pending review
+  projects [list]          List the project names in a store, with a hint for old worktree names
+    --json                 Output as JSON
+    --global               Operate on the global store
+    projects merge <from> <into> [--apply]
+                           Fold one project name into another (dry run unless --apply;
+                           writes a backup and one audit event first)
+    projects repair [--apply]
+                           Re-tag merged rows older versions of sleep saved as user-global,
+                           by their parents' project (dry run unless --apply)
+  quarantine [list]       List memories a connector flagged as an instruction attempt, pending review
     --all                  Include approved and rejected rows too (default: pending only)
     --json                 Output as JSON
     --global               Operate on the global store
@@ -7828,7 +7907,7 @@ async function main(command, args, flags, hippoRoot) {
      *  --hops value-less guard, so every current and future command - including the
      *  thin-client dispatch relays - sees --scope only as a non-empty string. */
     if ('scope' in flags && (typeof flags['scope'] !== 'string' || !flags['scope'].trim())) {
-        console.error('--scope requires a non-empty value (e.g. --scope slack:private:C1).');
+        printError('--scope requires a non-empty value (e.g. --scope slack:private:C1).');
         process.exit(1);
     }
     // parseArgs stores a value-less flag as boolean true, and NaN then survives every
@@ -7842,7 +7921,7 @@ async function main(command, args, flags, hippoRoot) {
         if (raw === undefined)
             continue;
         if (typeof raw !== 'string' || !raw.trim() || !Number.isFinite(Number(raw))) {
-            console.error(`--${key} requires a numeric value.`);
+            printError(`--${key} requires a numeric value.`);
             process.exit(1);
         }
     }
@@ -7850,7 +7929,7 @@ async function main(command, args, flags, hippoRoot) {
     // so no single coercion of an inline value would be correct for every one of them.
     for (const key of BOOLEAN_FLAGS) {
         if (Object.hasOwn(flags, key) && typeof flags[key] !== 'boolean') {
-            console.error(`--${key} takes no value`);
+            printError(`--${key} takes no value`);
             process.exit(1);
         }
     }
@@ -7859,14 +7938,14 @@ async function main(command, args, flags, hippoRoot) {
     if (unknownFlags.length > 0) {
         const names = unknownFlags.map((key) => `--${key}`).join(', ');
         if (DESTRUCTIVE_COMMANDS.has(command)) {
-            console.error(`Unknown flag ${names} for hippo ${command}. Nothing was changed.`);
+            printError(`Unknown flag ${names} for hippo ${command}. Nothing was changed.`);
             process.exit(2);
         }
-        console.error(`hippo: ignoring unknown flag ${names}. A later release will reject it.`);
+        printError(`hippo: ignoring unknown flag ${names}. A later release will reject it.`);
     }
     const refusal = Object.hasOwn(flags, 'dry-run') ? dryRunRefusal(command, args, flags) : null;
     if (refusal) {
-        console.error(refusal);
+        printError(refusal);
         process.exit(2);
     }
     switch (command) {
@@ -7882,7 +7961,7 @@ async function main(command, args, flags, hippoRoot) {
                 text = args.join(' ').trim();
             }
             if (!text || text.length < 3) {
-                console.error('Memory content too short (minimum 3 characters).');
+                printError('Memory content too short (minimum 3 characters).');
                 process.exit(1);
             }
             // Thin-client routing. When a server is up, simple `remember` calls go
@@ -7906,11 +7985,11 @@ async function main(command, args, flags, hippoRoot) {
                     const thinOwnerRaw = typeof flags['owner'] === 'string' ? flags['owner'] : undefined;
                     const thinOwnerCheck = validateOwner(thinOwnerRaw, { strict: isStrictOwnerEnv() });
                     if (!thinOwnerCheck.ok) {
-                        console.error(thinOwnerCheck.message);
+                        printError(thinOwnerCheck.message);
                         process.exit(1);
                     }
                     if (thinOwnerCheck.message)
-                        console.error(thinOwnerCheck.message);
+                        printError(thinOwnerCheck.message);
                     const remembered = await runViaServerIfAvailable(hippoRoot, async (info, apiKey) => {
                         const result = await client.remember(info.url, apiKey, {
                             content: text,
@@ -7922,6 +8001,8 @@ async function main(command, args, flags, hippoRoot) {
                         });
                         console.log(`Remembered [${result.id}] (via ${info.url})`);
                         console.log(`   Kind: ${result.kind} | Tenant: ${result.tenantId}`);
+                        for (const w of result.warnings ?? [])
+                            printError(`Warning: ${w}`);
                     });
                     if (remembered)
                         break;
@@ -7933,7 +8014,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'recall': {
             const query = args.join(' ').trim();
             if (!query) {
-                console.error('Please provide a search query.');
+                printError('Please provide a search query.');
                 process.exit(1);
             }
             await cmdRecall(hookStoreRoot(hippoRoot), query, flags);
@@ -7942,7 +8023,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'drill': {
             const summaryId = args[0];
             if (!summaryId) {
-                console.error('Usage: hippo drill <summary-id> [--limit N] [--budget N]');
+                printError('Usage: hippo drill <summary-id> [--limit N] [--budget N]');
                 process.exit(1);
             }
             cmdDrillDown(hippoRoot, summaryId, flags);
@@ -7951,7 +8032,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'assemble': {
             const sessionId = typeof flags['session'] === 'string' ? flags['session'] : args[0];
             if (!sessionId) {
-                console.error('Usage: hippo assemble --session <id> [--budget N] [--fresh-tail N] [--no-summarize-older] [--json]');
+                printError('Usage: hippo assemble --session <id> [--budget N] [--fresh-tail N] [--no-summarize-older] [--json]');
                 process.exit(1);
             }
             cmdAssemble(hippoRoot, sessionId, flags);
@@ -7961,7 +8042,7 @@ async function main(command, args, flags, hippoRoot) {
             const oldId = args[0];
             const newContent = args.slice(1).join(' ').trim();
             if (!oldId || !newContent) {
-                console.error('Usage: hippo supersede <old-id> "<new content>" [--layer L] [--tag T] [--pin]');
+                printError('Usage: hippo supersede <old-id> "<new content>" [--layer L] [--tag T] [--pin]');
                 process.exit(1);
             }
             cmdSupersede(hippoRoot, oldId, newContent, flags);
@@ -7970,7 +8051,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'explain': {
             const query = args.join(' ').trim();
             if (!query) {
-                console.error('Please provide a search query.');
+                printError('Please provide a search query.');
                 process.exit(1);
             }
             await cmdExplain(hippoRoot, query, flags);
@@ -7988,7 +8069,7 @@ async function main(command, args, flags, hippoRoot) {
                 break;
             }
             if (!sub) {
-                console.error('Usage: hippo trace <memory-id> | hippo trace record --task <t> --steps <json> --outcome <o>');
+                printError('Usage: hippo trace <memory-id> | hippo trace record --task <t> --steps <json> --outcome <o>');
                 process.exit(1);
             }
             cmdTrace(hippoRoot, sub, flags);
@@ -8012,11 +8093,13 @@ async function main(command, args, flags, hippoRoot) {
         case 'pre-compact': {
             // Bounded wait, not a TTY guard: an idle non-TTY pipe must not hang.
             const { text: stdinText, timedOut: stdinTimedOut } = await readStdinBounded();
-            resetHookInjection(hippoRoot, stdinText, null);
-            await cmdPreCompact(hookStoreRoot(hippoRoot), {
-                stdinText,
-                stdinTimedOut,
-                logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+            await runHookWithStores(async () => {
+                resetHookInjection(hippoRoot, stdinText, null);
+                await cmdPreCompact(hookStoreRoot(hippoRoot), {
+                    stdinText,
+                    stdinTimedOut,
+                    logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+                });
             });
             break;
         }
@@ -8025,7 +8108,7 @@ async function main(command, args, flags, hippoRoot) {
             const { text } = await readStdinBounded();
             const logFlag = flags['log-file'];
             const store = hookStoreRoot(hippoRoot);
-            const line = cmdPostCompact(store, {
+            const line = await runHookWithStores(() => cmdPostCompact(store, {
                 stdinText: text,
                 logFile: logFlag === true || logFlag === false || Array.isArray(logFlag) ? undefined : logFlag,
                 // Passed in, since capture.ts importing the sync would close an import cycle.
@@ -8037,8 +8120,8 @@ async function main(command, args, flags, hippoRoot) {
                     for (const warning of report.warnings)
                         log(`agent memories: ${warning}`);
                 },
-            });
-            if (line !== null)
+            }));
+            if (line !== null && line !== undefined)
                 console.log(line);
             break;
         }
@@ -8051,7 +8134,8 @@ async function main(command, args, flags, hippoRoot) {
                 const payload = (text ?? '').trim();
                 if (isInitialized(root) && payload) {
                     // SAFETY: JSON.parse returns a JSON value by definition.
-                    captureToolFailure(root, resolveTenantId({}), JSON.parse(payload));
+                    const failure = JSON.parse(payload);
+                    await runHookWithStores(() => captureToolFailure(root, resolveTenantId({}), failure));
                 }
             }
             catch {
@@ -8061,8 +8145,10 @@ async function main(command, args, flags, hippoRoot) {
         }
         case 'compact-resume': {
             const { text: stdinText, timedOut: stdinTimedOut } = await readStdinBounded();
-            resetHookInjection(hippoRoot, stdinText, 'compact');
-            cmdCompactResume(hookStoreRoot(hippoRoot), stdinText, stdinTimedOut);
+            await runHookWithStores(() => {
+                resetHookInjection(hippoRoot, stdinText, 'compact');
+                cmdCompactResume(hookStoreRoot(hippoRoot), stdinText, stdinTimedOut);
+            });
             break;
         }
         case 'codex-run':
@@ -8212,6 +8298,9 @@ async function main(command, args, flags, hippoRoot) {
         case 'dormant':
             cmdDormant(hippoRoot, args, flags);
             break;
+        case 'projects':
+            (await import('./cli/projects.js')).cmdProjects(hippoRoot, args, flags);
+            break;
         case 'quarantine':
             cmdQuarantine(hippoRoot, args, flags);
             break;
@@ -8233,7 +8322,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'support-bundle': {
             const outFlag = cardStringFlag(flags, 'out');
             if (outFlag === '') {
-                console.error('--out requires a file path.');
+                printError('--out requires a file path.');
                 process.exit(1);
             }
             const includeLogs = flags['include-logs'] === true;
@@ -8248,10 +8337,10 @@ async function main(command, args, flags, hippoRoot) {
             }
             catch (err) {
                 if (err instanceof Error && 'code' in err && err.code === 'EEXIST') {
-                    console.error(`${file} already exists; pass --out to choose another file. Nothing was written.`);
+                    printError(`${file} already exists; pass --out to choose another file. Nothing was written.`);
                 }
                 else {
-                    console.error(err instanceof Error ? err.message : String(err));
+                    printError(err instanceof Error ? err.message : String(err));
                 }
                 process.exit(1);
             }
@@ -8283,7 +8372,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'forget': {
             const id = args[0];
             if (!id) {
-                console.error('Please provide a memory ID.');
+                printError('Please provide a memory ID.');
                 process.exit(1);
             }
             // Archive has its own HTTP route (POST /v1/memories/:id/archive); route
@@ -8291,7 +8380,7 @@ async function main(command, args, flags, hippoRoot) {
             const archive = flags['archive'] === true;
             const reason = typeof flags['reason'] === 'string' ? flags['reason'] : null;
             if (archive && !reason) {
-                console.error(ARCHIVE_REASON_REQUIRED);
+                printError(ARCHIVE_REASON_REQUIRED);
                 process.exit(1);
             }
             if (flags['dry-run'] === true) {
@@ -8315,7 +8404,7 @@ async function main(command, args, flags, hippoRoot) {
                     if (client.classifyTransportFailure(err) !== 'none')
                         throw err;
                     const msg = err instanceof Error ? err.message : String(err);
-                    console.error(archive ? `Could not archive ${id}: ${msg}` : msg);
+                    printError(archive ? `Could not archive ${id}: ${msg}` : msg);
                     process.exit(1);
                 }
             });
@@ -8327,7 +8416,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'inspect': {
             const id = args[0];
             if (!id) {
-                console.error('Please provide a memory ID.');
+                printError('Please provide a memory ID.');
                 process.exit(1);
             }
             cmdInspect(hippoRoot, id);
@@ -8337,7 +8426,7 @@ async function main(command, args, flags, hippoRoot) {
             // Bounded, not a TTY guard (DF1 T2, docs/plans/2026-08-23-df1-snapshot-lifecycle.md):
             // the hot stdin path and a manual run share this one command.
             const { text: stdinText } = await readStdinBounded();
-            await cmdContext(hookStoreRoot(hippoRoot), args, flags, stdinText);
+            await runHookWithStores(() => cmdContext(hookStoreRoot(hippoRoot), args, flags, stdinText));
             break;
         }
         case 'hook':
@@ -8363,7 +8452,7 @@ async function main(command, args, flags, hippoRoot) {
         case 'promote': {
             const id = args[0];
             if (!id) {
-                console.error('Please provide a memory ID.');
+                printError('Please provide a memory ID.');
                 process.exit(1);
             }
             const promoted = await runViaServerIfAvailable(hippoRoot, async (info, apiKey) => {
@@ -8372,7 +8461,7 @@ async function main(command, args, flags, hippoRoot) {
                     console.log(`Promoted ${id} to global store as ${result.globalId}`);
                 }
                 catch (err) {
-                    console.error(`Failed to promote: ${err.message}`);
+                    printError(`Failed to promote: ${err.message}`);
                     process.exit(1);
                 }
             });
@@ -8426,13 +8515,13 @@ async function main(command, args, flags, hippoRoot) {
                         console.log('Use --force to share anyway.');
                     }
                     else {
-                        console.error(`Memory not found: ${shareId}`);
+                        printError(`Memory not found: ${shareId}`);
                         process.exit(1);
                     }
                 }
             }
             else {
-                console.error('Usage: hippo share <memory_id> [--force] or hippo share --auto [--dry-run]');
+                printError('Usage: hippo share <memory_id> [--force] or hippo share --auto [--dry-run]');
                 process.exit(1);
             }
             break;
@@ -8510,7 +8599,7 @@ async function main(command, args, flags, hippoRoot) {
                     captureSource = 'last-session';
             }
             if (!captureSource) {
-                console.error('Usage: hippo capture --stdin|--file <path>|--last-session [--transcript <path>] [--log-file <path>] [--dry-run] [--global]');
+                printError('Usage: hippo capture --stdin|--file <path>|--last-session [--transcript <path>] [--log-file <path>] [--dry-run] [--global]');
                 process.exit(1);
             }
             // Bounded, and only when last-session has no explicit path: the
@@ -8558,7 +8647,7 @@ async function main(command, args, flags, hippoRoot) {
             const portRaw = flags['port'] ?? process.env['HIPPO_PORT'] ?? '6789';
             const port = Number(portRaw);
             if (!Number.isFinite(port) || port < 0) {
-                console.error(`Invalid --port: ${String(portRaw)}`);
+                printError(`Invalid --port: ${String(portRaw)}`);
                 process.exit(1);
             }
             const host = typeof flags['host'] === 'string' ? flags['host'] : '127.0.0.1';
@@ -8575,19 +8664,19 @@ async function main(command, args, flags, hippoRoot) {
             requireInit(hippoRoot);
             if (flags['churn'] === true) {
                 if (args[0] || flags['id'] !== undefined) {
-                    console.error('Usage: hippo invalidate --churn [--dry-run]');
-                    console.error('--churn takes no pattern or --id.');
+                    printError('Usage: hippo invalidate --churn [--dry-run]');
+                    printError('--churn takes no pattern or --id.');
                     process.exit(1);
                 }
                 if (!isGitRepo(process.cwd())) {
-                    console.error('hippo invalidate --churn must run inside a git repository.');
+                    printError('hippo invalidate --churn must run inside a git repository.');
                     process.exit(1);
                 }
                 const churnDryRun = flags['dry-run'] === true;
                 let churnFailed = false;
                 for (const { root, result } of runChurnStaleForRepo(hippoRoot, churnDryRun)) {
                     if (result.error) {
-                        console.error(`Churn-staleness check failed for ${root}: ${result.error}`);
+                        printError(`Churn-staleness check failed for ${root}: ${result.error}`);
                         churnFailed = true;
                         continue;
                     }
@@ -8613,21 +8702,21 @@ async function main(command, args, flags, hippoRoot) {
             if (flags['id'] === true) {
                 // Value-less --id must never silently fall through to pattern mode
                 // (pattern mode writes broadly; an ignored --id reverses user intent).
-                console.error('--id requires a memory id');
+                printError('--id requires a memory id');
                 process.exit(1);
             }
             const onlyId = typeof flags['id'] === 'string' ? flags['id'] : undefined;
             if (typeof flags['dry-run'] === 'string') {
                 // Dead: the earlier global BOOLEAN_FLAGS guard now exits first on any --dry-run=<v>.
                 // Kept as defence in depth on a destructive command.
-                console.error('--dry-run takes no value');
+                printError('--dry-run takes no value');
                 process.exit(1);
             }
             const dryRun = flags['dry-run'] === true;
             if ((target && onlyId) || (!target && !onlyId)) {
-                console.error('Usage: hippo invalidate "<old pattern>" [--dry-run] [--reason "<why>"]');
-                console.error('       hippo invalidate --id <memory-id> [--dry-run] [--reason "<why>"]');
-                console.error('Pass a pattern OR --id, not both. Tag matching is EXACT: the full pattern must equal a tag.');
+                printError('Usage: hippo invalidate "<old pattern>" [--dry-run] [--reason "<why>"]');
+                printError('       hippo invalidate --id <memory-id> [--dry-run] [--reason "<why>"]');
+                printError('Pass a pattern OR --id, not both. Tag matching is EXACT: the full pattern must equal a tag.');
                 process.exit(1);
             }
             const reason = flags['reason'] || null;
@@ -8686,7 +8775,7 @@ async function main(command, args, flags, hippoRoot) {
             cmdGraph(hippoRoot, args, flags);
             break;
         default:
-            console.error(`Unknown command: ${command}`);
+            printError(`Unknown command: ${command}`);
             printUsage();
             process.exit(1);
     }
@@ -8697,7 +8786,7 @@ export async function runCli(argv = process.argv) {
         await main(command, args, flags, getHippoRoot(process.cwd()));
     }
     catch (err) {
-        console.error('Error:', err instanceof Error ? err.message : err);
+        printError('Error:', err instanceof Error ? err.message : err);
         process.exit(1);
     }
 }