hippo-memory 1.59.0 → 1.61.0

package/dist/consolidate/sleep.js

@@ -0,0 +1,209 @@
+/**
+ * Consolidation engine ("Sleep") for Hippo.
+ *
+ * Steps:
+ * 1. Decay pass  - remove entries below strength threshold
+ * 2. Merge pass  - find episodic entries with high text overlap, create semantic summaries
+ * 3. Stats tracking
+ */
+import { evalNow } from '../ablation.js';
+import { canAutoDelete } from '../memory.js';
+import { loadAllEntries } from '../store/entry-reads.js';
+import { batchWriteAndDelete, memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { appendConsolidationRun, loadSessionDecayContext, incrementSleepCount } from '../store/index-and-stats.js';
+import { replaceDetectedConflicts } from '../store/conflicts.js';
+import { openHippoDb, closeHippoDb } from '../db.js';
+import { countExpiredDormant, purgeExpiredDormant } from '../dormant.js';
+import { loadConfig } from '../config.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
+import { migrateDefaultHalfLife, LEGACY_TYPED_HALF_LIFE } from '../half-life-migration.js';
+import { log } from '../log.js';
+import { decayPass } from './decay.js';
+import { retireHeldTexts, mergePass } from './merge.js';
+import { detectConflicts } from './conflicts.js';
+import { lazyConsolidateDb, newConsolidationResult } from './run.js';
+import { promoteSessionTraces, replayPass } from './traces.js';
+import { llmPasses } from './llm-passes.js';
+import { physicsPass } from './physics-pass.js';
+/**
+ * Run a full consolidation pass.
+ */
+export async function consolidate(hippoRoot, options = {}) {
+    const now = options.now ?? evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
+    const dryRun = options.dryRun ?? false;
+    const result = newConsolidationResult(dryRun);
+    const halfLife = migrateHalfLives(hippoRoot, dryRun, result);
+    // L9: host-wide by design. Consolidation runs across all tenants in one
+    // pass — per-tenant filtering would create N consolidation runs per host
+    // with no cross-tenant dedup. The api.sleep audit row tags this with the
+    // admin synthetic actor; see api.ts:2050 for the rationale.
+    const all = loadAllEntries(hippoRoot);
+    if (dryRun)
+        for (const e of all)
+            e.half_life_days = halfLife.halfLives.get(e.id) ?? e.half_life_days;
+    const backingObjects = memoriesBackingObjects(hippoRoot);
+    // Retirable: auto-deletable (never pinned, raw or kept for good) and not backing a first-class object.
+    const retirable = (entry) => canAutoDelete(entry) && !backingObjects.has(entry.id);
+    const snapshot = new Map(structuredClone(all).map((e) => [e.id, e]));
+    // Load decay options from config + session context
+    const config = loadConfig(hippoRoot);
+    const sessionCtx = loadSessionDecayContext(hippoRoot);
+    const decayOpts = {
+        decayBasis: config.decayBasis,
+        avgSessionIntervalDays: sessionCtx.avgSessionIntervalDays,
+        sleepCount: sessionCtx.sleepCount,
+    };
+    const consolidateDb = lazyConsolidateDb(hippoRoot, dryRun);
+    const run = {
+        hippoRoot, now, dryRun, config, decayOpts, result, all, retirable,
+        getConsolidateDb: consolidateDb.get,
+        survivors: [],
+        // Collect all writes/deletes and batch them at the end
+        pendingWrites: [],
+        pendingDeletes: [],
+        pendingDormant: [],
+    };
+    const decay = decayPass(run);
+    let mergesSkippedRejected = 0;
+    try {
+        promoteSessionTraces(run);
+        replayPass(run);
+        await llmPasses(run, options.fetcher);
+        physicsPass(run);
+        retireHeldTexts(run);
+        mergesSkippedRejected = mergePass(run);
+    }
+    finally {
+        consolidateDb.close();
+    }
+    if (mergesSkippedRejected > 0) {
+        log.warn(`consolidate: skipped ${mergesSkippedRejected} merge(s) whose content matches a rejected value`);
+    }
+    flushPending(run, snapshot);
+    expireDormant(run);
+    if (!dryRun)
+        logRun(run, decay);
+    return result;
+}
+// A changed default half-life moves memories still on the old base first,
+// so this pass decays them at the new one (src/half-life-migration.ts).
+function migrateHalfLives(hippoRoot, dryRun, result) {
+    const halfLife = migrateDefaultHalfLife(hippoRoot, loadConfig(hippoRoot).defaultHalfLifeDays, { dryRun });
+    if (halfLife.rescaled > 0) {
+        result.details.push(`  ⏳ ${dryRun ? 'would move' : 'moved'} ${halfLife.rescaled} memories from the ${halfLife.from}-day to the ${halfLife.to}-day half-life`);
+    }
+    if (halfLife.typed > 0) {
+        result.details.push(`  ⏳ ${dryRun ? 'would move' : 'moved'} ${halfLife.typed} memories of decisions, incidents and other objects from the ${LEGACY_TYPED_HALF_LIFE}-day to the ${halfLife.to}-day half-life`);
+    }
+    return halfLife;
+}
+function flushPending(run, snapshot) {
+    const { result, pendingDeletes, pendingDormant } = run;
+    result.removedIds = pendingDeletes;
+    // One transaction; the snapshot keeps what the DAG passes and other writers changed while sleep ran.
+    // Dormant moves ride in the same transaction (src/dormant.ts).
+    if (run.dryRun)
+        return;
+    const left = new Set(batchWriteAndDelete(run.hippoRoot, run.pendingWrites, pendingDeletes, { snapshot, dormant: pendingDormant }));
+    for (const id of [...pendingDeletes, ...pendingDormant.map((m) => m.entry.id)]) {
+        if (!left.has(id))
+            result.details.push(`  ↩  ${id} not removed: pinned or already gone before sleep saved`);
+    }
+    result.removedIds = pendingDeletes.filter((id) => left.has(id));
+    result.removed = result.removedIds.length;
+    result.dormant = pendingDormant.filter((m) => left.has(m.entry.id)).length;
+}
+// Dormant retention: a dormant memory nobody restored within
+// dormant.retentionDays is deleted for good (0 keeps them forever). Runs
+// even when dormant.enabled is off, so turning it off still ages out what
+// earlier sleeps kept.
+function expireDormant(run) {
+    const { config, result, dryRun } = run;
+    if (!(config.dormant.retentionDays > 0))
+        return;
+    const cutoff = new Date(run.now.getTime() - config.dormant.retentionDays * 24 * 60 * 60 * 1000).toISOString();
+    const db = openHippoDb(run.hippoRoot);
+    try {
+        result.dormantExpired = dryRun ? countExpiredDormant(db, cutoff) : purgeExpiredDormant(db, cutoff);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    if (result.dormantExpired > 0) {
+        result.details.push(`  ⌛ ${dryRun ? 'would expire' : 'expired'} ${result.dormantExpired} dormant memor${result.dormantExpired === 1 ? 'y' : 'ies'} older than ${config.dormant.retentionDays} days`);
+    }
+}
+// -------------------------------------------------------------------------
+// 4. Log run
+// -------------------------------------------------------------------------
+function logRun(run, decay) {
+    const { hippoRoot, now, result } = run;
+    const detectedConflicts = detectConflicts(run.survivors, now, run.decayOpts, decay.rescuedIds);
+    replaceDetectedConflicts(hippoRoot, detectedConflicts, now.toISOString());
+    if (detectedConflicts.length > 0) {
+        result.details.push(`  ⚠️ detected ${detectedConflicts.length} memory conflict${detectedConflicts.length === 1 ? '' : 's'}`);
+    }
+    appendConsolidationRun(hippoRoot, {
+        timestamp: now.toISOString(),
+        decayed: result.decayed,
+        merged: result.merged,
+        removed: result.removed,
+    });
+    incrementSleepCount(hippoRoot);
+    if (decay.rescuedEntries.length > 0)
+        auditRescues(run, decay);
+}
+// One audit row per rescue (attributability, D1). Written here, AFTER
+// batchWriteAndDelete has committed this cycle's writes/deletes
+// (and after conflict detection + run logging), not inline in the decay
+// pass — same durability posture as api.ts's top-level 'consolidate'
+// summary audit row (written only once the whole sleep has completed).
+// Writing it earlier would assert rescues for a cycle whose effects
+// never landed if a later phase threw. Real writes only — dry-run
+// previews the decision (details line above) but persists nothing.
+function auditRescues(run, { rescuedEntries, rankById }) {
+    const { result } = run;
+    try {
+        const auditDb = openHippoDb(run.hippoRoot);
+        try {
+            // Review-round F5: per-row try/catch, not one try/catch around the
+            // whole loop — a single failed appendAuditEvent must not silently
+            // drop every remaining row. Mirrors the physics pass's
+            // skipped-warning precedent: count losses, keep
+            // the overall fail-soft posture, tell the operator via details.
+            let auditFailures = 0;
+            for (const entry of rescuedEntries) {
+                try {
+                    const rank = rankById.get(entry.id);
+                    appendAuditEvent(auditDb, {
+                        tenantId: entry.tenantId,
+                        actor: 'sleep',
+                        op: 'mv_rescue',
+                        targetId: entry.id,
+                        metadata: rank
+                            ? { rank: rank.rank, totalNonPinned: rank.totalNonPinned, keepN: rank.keepN, score: rank.score }
+                            : {},
+                    });
+                }
+                catch (error) {
+                    auditFailures++;
+                    reportAuditWriteFailure('mv_rescue', String(error), entry.id);
+                }
+            }
+            if (auditFailures > 0) {
+                result.details.push(`  ⚠️ memory-value: ${auditFailures} mv_rescue audit row${auditFailures === 1 ? '' : 's'} ` +
+                    `failed to write (the rescue itself still landed)`);
+            }
+        }
+        finally {
+            closeHippoDb(auditDb);
+        }
+    }
+    catch {
+        // openHippoDb/closeHippoDb-level failure: audit must never crash a
+        // mutation (mirrors store.ts's audit() posture).
+        result.details.push(`  ⚠️ memory-value: mv_rescue audit unavailable this cycle ` +
+            `(${rescuedEntries.length} rescue${rescuedEntries.length === 1 ? '' : 's'} not audited)`);
+    }
+}
+//# sourceMappingURL=sleep.js.map

package/dist/consolidate/traces.d.ts

@@ -0,0 +1,4 @@
+import { type SleepRun } from './run.js';
+export declare function promoteSessionTraces(run: SleepRun): void;
+export declare function replayPass(run: SleepRun): void;
+//# sourceMappingURL=traces.d.ts.map

package/dist/consolidate/traces.js

@@ -0,0 +1,178 @@
+import { isRecallBoostAblated } from '../ablation.js';
+import { Layer, createMemory, markRetrieved } from '../memory.js';
+import { findPromotableSessions, traceExistsForSession, listSessionEvents } from '../store/sessions.js';
+import { rejectionDigest, findRejectedValue } from '../rejection.js';
+import { sampleForReplay } from '../replay.js';
+import { renderTraceContent } from '../trace.js';
+import { resolveTenantId } from '../tenant.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
+import { commonDerivationScope } from '../recall-scope.js';
+import { log } from '../log.js';
+import { REPLAY_COUNT_DEFAULT, isJsonString } from './run.js';
+// -------------------------------------------------------------------------
+// 1.4. Auto-promote complete sessions to traces
+// -------------------------------------------------------------------------
+//
+// For each session within the configured window that has a `session_complete`
+// event and no existing trace (idempotency via the source_session_id column),
+// render the action sequence as markdown and persist a Layer.Trace memory.
+// Traces inherit decay, search, replay, and physics from the base MemoryEntry.
+export function promoteSessionTraces(run) {
+    const { result } = run;
+    if (run.dryRun || run.config.autoTraceCapture === false)
+        return;
+    let tracesSkippedRejected = 0;
+    const windowDays = run.config.autoTraceWindowDays ?? 7;
+    const sinceMs = run.now.getTime() - windowDays * 24 * 60 * 60 * 1000;
+    // Auto-trace currently runs in a single-tenant context (the env-resolved
+    // tenant for this process). Multi-tenant deployments that want
+    // consolidation across all tenants need a per-tenant loop layered on top
+    // of this — tracked in docs/plans/2026-05-02-continuity-tables-tenant-scope.md.
+    const consolidationTenant = resolveTenantId({});
+    const promotable = findPromotableSessions(run.hippoRoot, consolidationTenant, sinceMs);
+    for (const session of promotable) {
+        const built = sessionTrace(run, consolidationTenant, session.session_id);
+        if (!built)
+            continue;
+        const { trace, outcome } = built;
+        if (traceRejected(run, trace, session.session_id)) {
+            tracesSkippedRejected++;
+            continue;
+        }
+        run.pendingWrites.push(trace);
+        run.survivors.push(trace);
+        result.promotedTraces++;
+        result.details.push(`  🧬 promoted trace ${trace.id} from session ${session.session_id} (${outcome})`);
+    }
+    if (result.promotedTraces > 0) {
+        result.details.push(`  🧬 promoted ${result.promotedTraces} trace${result.promotedTraces === 1 ? '' : 's'} from completed session${result.promotedTraces === 1 ? '' : 's'}`);
+    }
+    if (tracesSkippedRejected > 0) {
+        log.warn(`consolidate: skipped ${tracesSkippedRejected} auto-promoted trace(s) whose content matches a rejected value`);
+    }
+}
+/** The trace a completed session renders to, or null when it already has one or cannot be promoted. */
+function sessionTrace(run, consolidationTenant, sessionId) {
+    // Idempotency: skip if a trace for this session already exists.
+    if (traceExistsForSession(run.hippoRoot, consolidationTenant, sessionId))
+        return null;
+    const events = listSessionEvents(run.hippoRoot, consolidationTenant, {
+        session_id: sessionId,
+        limit: 1000,
+    });
+    // T7: a mixed-scope session would otherwise leak into one trace.
+    const sessionScope = commonDerivationScope(events.map((e) => e.scope));
+    if (!sessionScope.ok) {
+        run.result.tracesSkippedMixedScope++;
+        run.result.details.push(`  ⏭  skipped session ${sessionId}: events span mixed scopes`);
+        return null;
+    }
+    const completeEvent = events.find((e) => e.event_type === 'session_complete');
+    if (!completeEvent)
+        return null; // defence-in-depth; findPromotableSessions filters already.
+    const outcomeRaw = completeEvent.content;
+    if (outcomeRaw !== 'success' && outcomeRaw !== 'failure' && outcomeRaw !== 'partial') {
+        // Malformed terminal event — skip rather than crash the whole sleep.
+        return null;
+    }
+    const outcome = outcomeRaw;
+    const steps = events
+        .filter((e) => e.event_type !== 'session_complete')
+        .map((e) => ({ action: e.content, observation: '' }));
+    // SAFETY: session event metadata is a free-form Record<string, unknown>
+    // bag; summary is optional and is only trusted once isJsonString below
+    // confirms it is actually a string.
+    const summaryValue = completeEvent.metadata.summary;
+    const summary = isJsonString(summaryValue) ? summaryValue : '(untitled)';
+    const trace = createMemory(renderTraceContent({ task: summary, steps, outcome }), {
+        layer: Layer.Trace,
+        trace_outcome: outcome,
+        source_session_id: sessionId,
+        tags: ['auto-promoted'],
+        source: 'auto-promote',
+        scope: sessionScope.scope,
+        // T1 fix (2026-08-15 hardening pass): stamp the trace into the SAME
+        // tenant the traceExistsForSession idempotency check (above) runs
+        // under. Before
+        // this, createMemory omitted tenantId and the trace always landed
+        // 'default' (memory.ts:535) while the idempotency check ran under
+        // consolidationTenant — for any non-default tenant that check never
+        // hit, and the trace regenerated every sleep.
+        tenantId: consolidationTenant,
+        baseHalfLifeDays: run.config.defaultHalfLifeDays,
+    });
+    return { trace, outcome };
+}
+// AT1 (same producer-side pattern as the merge pass below): traceExistsForSession
+// only sees rows CURRENTLY in the store — once a rejected trace is
+// removed, that idempotency check no longer blocks regeneration, and
+// this write would otherwise reach batchWriteAndDelete's guard bypass
+// unchecked, resurrecting it every sleep. Check under THE ENTRY'S OWN
+// stamped tenantId (read off `trace` after createMemory — never guess
+// the tenant) + the built content's digest. A hit skips the push
+// entirely: not counted as promoted, not added to survivors.
+function traceRejected(run, trace, sessionId) {
+    const consolidateDb = run.getConsolidateDb();
+    if (!consolidateDb)
+        return false;
+    const traceDigest = rejectionDigest(trace.content);
+    const tombstone = findRejectedValue(consolidateDb, trace.tenantId, traceDigest);
+    if (!tombstone)
+        return false;
+    try {
+        appendAuditEvent(consolidateDb, {
+            tenantId: trace.tenantId,
+            actor: 'sleep',
+            op: 'reject_refusal',
+            metadata: {
+                digest: traceDigest,
+                reason: tombstone.reason,
+                sourceSessionId: sessionId,
+            },
+        });
+    }
+    catch (error) {
+        reportAuditWriteFailure('reject_refusal', String(error));
+    }
+    return true;
+}
+// -------------------------------------------------------------------------
+// 1.5. Replay pass — rehearse high-value survivors
+// -------------------------------------------------------------------------
+//
+// Biologically-inspired counterpart to hippocampal replay during slow-wave
+// sleep: sample N memories weighted by outcome + valence + under-rehearsal
+// + idle time, then apply the same retrieval-strengthening `markRetrieved`
+// applies to real queries. Distinct from decay (removal), physics (motion),
+// and merge (compression) — this is the "rehearse the important stuff so
+// it doesn't fade" pass.
+export function replayPass(run) {
+    const { survivors, now } = run;
+    const replayCount = run.config.replay?.count ?? REPLAY_COUNT_DEFAULT;
+    // EVAL-ONLY ablation (see ablation.ts): replay rehearsal IS recall
+    // strengthening (same markRetrieved dynamics), so the strengthen-off arm
+    // silences the whole pass - markRetrieved would return unmutated entries
+    // and persisting them anyway would still refresh updated_at / mirrors.
+    if (!(replayCount > 0 && survivors.length > 0 && !isRecallBoostAblated()))
+        return;
+    const seed = Math.floor(now.getTime() / 1000) & 0xffffffff;
+    const picked = sampleForReplay(survivors, replayCount, now, seed);
+    if (picked.length === 0)
+        return;
+    const rehearsed = markRetrieved(picked, now);
+    const rehearsedById = new Map(rehearsed.map((e) => [e.id, e]));
+    // Update survivors in place so downstream passes see rehearsed state.
+    for (let i = 0; i < survivors.length; i++) {
+        const replacement = rehearsedById.get(survivors[i].id);
+        if (replacement)
+            survivors[i] = replacement;
+    }
+    run.result.replayed = rehearsed.length;
+    run.result.details.push(`  💭 replayed ${rehearsed.length} memor${rehearsed.length === 1 ? 'y' : 'ies'}: ` +
+        rehearsed.map((e) => e.id).join(', '));
+    if (!run.dryRun) {
+        for (const r of rehearsed)
+            run.pendingWrites.push(r);
+    }
+}
+//# sourceMappingURL=traces.js.map

package/dist/context-auto.js

@@ -1,13 +1,13 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 const SKIPPED_PATH_TERMS = ['src', 'dist', 'test', 'tests', 'node_modules', 'index'];
+// stderr is dropped because git's warnings (line-ending notices, for one) would otherwise become query terms.
+function readGit(args) {
+    return execFileSync('git', args, { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim();
+}
 /** A context query from the cwd's git state ('' means `getContext` lists by strength); kept out of the api layer, which never shells out. */
 export function autoDetectContext() {
     try {
-        const diff = execSync('git diff --name-only HEAD 2>&1', {
-            encoding: 'utf8',
-            timeout: 3000,
-            windowsHide: true,
-        }).trim();
+        const diff = readGit(['diff', '--name-only', 'HEAD']);
         if (diff) {
             const terms = diff
                 .split('\n')
@@ -17,11 +17,7 @@ export function autoDetectContext() {
             if (terms.length > 0)
                 return terms.join(' ');
         }
-        const branch = execSync('git branch --show-current 2>&1', {
-            encoding: 'utf8',
-            timeout: 3000,
-            windowsHide: true,
-        }).trim();
+        const branch = readGit(['branch', '--show-current']);
         if (branch && branch !== 'main' && branch !== 'master') {
             return branch.replace(/[-_/]/g, ' ');
         }

package/dist/context-render.d.ts

@@ -1,6 +1,6 @@
 import { type MemoryEntry } from './memory.js';
 import { type SessionHandoff } from './handoff.js';
-import type { SessionEvent, TaskSnapshot } from './store.js';
+import type { SessionEvent, TaskSnapshot } from './store/rows.js';
 import type { AssembleCost, AssembleResult, AssembledContextItem, ContextCost, ContextResultEntry, DrillDownChild, DrillDownCost, DrillDownResult } from './api.js';
 export declare function snapshotText(s: TaskSnapshot): string;
 export declare function handoffText(h: SessionHandoff): string;

package/dist/context-render.js

@@ -1,7 +1,7 @@
 // The strings a context block prints. The budget prices these same strings, so selection and print cannot drift.
 import { calculateStrength, confidenceFacets, confidenceLabel } from './memory.js';
 import { evalNow } from './ablation.js';
-import { estimateTokens } from './search.js';
+import { estimateTokens } from './token-ledger.js';
 import { renderAmbientSummary } from './ambient.js';
 import { formatHandoffEvidenceLine } from './handoff.js';
 export function snapshotText(s) {

package/dist/customer-notes.d.ts

@@ -19,6 +19,7 @@
  *
  * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
  */
+import { type KeysetPosition } from './keyset.js';
 export type NoteStatus = 'active' | 'superseded' | 'closed';
 export declare const VALID_NOTE_STATES: ReadonlySet<NoteStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). note is a body, so a larger cap
@@ -61,6 +62,8 @@ export interface ListCustomerNotesOpts {
     /** Filter to a single customer. */
     customer?: string;
     limit?: number;
+    /** Resume after this row: the position the previous page ended on. */
+    after?: KeysetPosition;
 }
 /**
  * Create a customer_note (or a new version that supersedes an existing one). Writes

package/dist/customer-notes.js

@@ -21,12 +21,13 @@
  */
 import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
 import { assertTenantId } from './tenant.js';
-import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
+import { markGraphDirty, removeGraphEntitiesForObject } from './graph/write.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
+import { keysetAfter } from './keyset.js';
 export const VALID_NOTE_STATES = new Set([
     'active',
     'superseded',
@@ -284,6 +285,7 @@ export function loadCustomerNoteById(hippoRoot, tenantId, id) {
 export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadCustomerNotes', tenantId);
     const limit = opts.limit ?? 100;
+    const after = keysetAfter('created_at', 'id', opts.after);
     if (opts.status && !VALID_NOTE_STATES.has(opts.status)) {
         throw new BadRequestError(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
     }
@@ -299,13 +301,13 @@ export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
             clauses.push('customer = ?');
             params.push(opts.customer);
         }
-        params.push(limit);
+        params.push(...after.params, limit);
         // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns
         // regardless of the dynamic WHERE clause built above; .all() returns rows
         // in that shape.
         const rows = db.prepare(`
       SELECT ${NOTE_COLS} FROM customer_notes
-      WHERE ${clauses.join(' AND ')}
+      WHERE ${clauses.join(' AND ')}${after.sql}
       ORDER BY created_at DESC, id DESC
       LIMIT ?
     `).all(...params);

package/dist/dag.js

@@ -1,11 +1,13 @@
 import { createMemory, Layer } from './memory.js';
-import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
+import { loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store/summaries.js';
 import { RejectedValueError } from './rejection.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { derivationScope, derivationPartitionKey } from './recall-scope.js';
 import { loadConfig } from './config.js';
 import { neverAutoShareTags } from './shared.js';
+import { log } from './log.js';
 export function clusterFacts(facts) {
     if (facts.length === 0)
         return [];
@@ -47,9 +49,9 @@ Write a single concise paragraph (2-4 sentences) that captures all the key infor
 export async function generateDagSummary(label, factContents, opts) {
     const model = opts.model ?? 'claude-sonnet-4-6';
     const fetchFn = opts.fetcher ?? fetch;
-    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecrets(f)}`).join('\n');
+    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecretsStrict(f)}`).join('\n');
     const prompt = DAG_SUMMARY_PROMPT
-        .replace('{label}', redactSecrets(label))
+        .replace('{label}', redactSecretsStrict(label))
         .replace('{facts}', factsBlock);
     let res;
     try {
@@ -144,7 +146,7 @@ export async function buildDag(hippoRoot, facts, opts) {
             // The tombstone check itself is tenant-scoped for free: writeEntry ->
             // writeEntryDbOnly -> upsertEntryRow calls
             // checkRejectionGuard(db, entry.tenantId ?? 'default', ...)
-            // (store.ts:1172), reading tenantId off the entry being written. Now
+            // (store/entry-writes.ts), reading tenantId off the entry being written. Now
             // that summaryEntry carries factTenant instead of the implicit
             // 'default', the guard consults that tenant's tombstones — no
             // separate check needed here (unlike consolidate.ts's merge pass,
@@ -157,7 +159,7 @@ export async function buildDag(hippoRoot, facts, opts) {
             catch (err) {
                 if (err instanceof RejectedValueError) {
                     result.rejected++;
-                    console.error(`[buildDag] cluster "${cluster.label}" skipped: summary matches a rejected value`);
+                    log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
                     continue;
                 }
                 throw err;
@@ -169,7 +171,7 @@ export async function buildDag(hippoRoot, facts, opts) {
                 result.factsLinked++;
             }
             // v0.30 / E3 — cancel the cascade of dirty-marks fired by member
-            // writeEntry calls (E2 hook on writeEntryDbOnly at store.ts:1214).
+            // writeEntry calls (E2 hook on writeEntryDbOnly in store/entry-writes.ts).
             // The summary we just built IS fresh, no rebuild needed. Without this,
             // E3 in the SAME sleep cycle would re-rebuild every new summary
             // (2x LLM cost). plan-eng-r1 HIGH must-fix.
@@ -235,7 +237,7 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
                     result.zeroChildSkipped++;
                 // changed=false → race lost / row vanished; silently skip. `refused`
                 // is always false here — applyRebuildResult only checks the
-                // tombstone when bumpRebuildCount is true (store.ts:3398).
+                // tombstone when bumpRebuildCount is true (store/summaries.ts).
                 continue;
             }
             // Derive label from summary's existing entity tags (mirrors clusterFacts)
@@ -271,11 +273,10 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
         catch (err) {
             // Per-summary failure isolation — one throw doesn't abort the queue.
             // independent-review MED #2 fold: log enough to triage in production
-            // (audit() wraps its own writes try/catch per store.ts:2566, so a
+            // (audit() wraps its own writes try/catch per store/audit-event.ts, so a
             // throw here is exotic: SQLite I/O error, prepare failure, etc).
             result.failed++;
-            // eslint-disable-next-line no-console
-            console.error(`[rebuildDirtySummaries] summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+            log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return result;
@@ -353,7 +354,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
             catch (err) {
                 if (err instanceof RejectedValueError) {
                     result.rejected++;
-                    console.error(`[buildEntityProfiles] cluster "${cluster.label}" skipped: profile matches a rejected value`);
+                    log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
                     continue;
                 }
                 throw err;

package/dist/dashboard-actions.d.ts

@@ -0,0 +1,20 @@
+import type { MemoryEntry } from './memory.js';
+import { type ActionBody } from './dashboard-params.js';
+/** What an action hands the router: a status, a JSON body, and whether the store changed. */
+export interface ActionResult {
+    status: number;
+    body: unknown;
+    /** True when a write committed, so the router drops the snapshot. */
+    changed: boolean;
+    /** The live entry an action acted on, so the router can build the detail after the cache is dropped. */
+    entry?: MemoryEntry;
+}
+/** Sets `pinned`; the audit row says `remember` with actor `dashboard`, the same op the old star toggle wrote. */
+export declare function pinMemory(hippoRoot: string, tenantId: string, rawId: string, body: ActionBody): ActionResult;
+/** Marks a memory wrong, the same signal as `hippo outcome --bad`. */
+export declare function markWrong(hippoRoot: string, tenantId: string, rawId: string): ActionResult;
+/** Deletes a memory like `hippo forget`; a raw receipt is append-only and answers 409 with the archive hint. */
+export declare function forgetMemory(hippoRoot: string, tenantId: string, rawId: string): ActionResult;
+/** Keeps one side of an open conflict and weakens the other; every refusal maps to its own status. */
+export declare function resolveOpenConflict(hippoRoot: string, tenantId: string, conflictId: number, body: ActionBody): ActionResult;
+//# sourceMappingURL=dashboard-actions.d.ts.map