hippo-memory 1.60.0 → 1.61.0

package/dist/dashboard.js

@@ -1,124 +1,19 @@
-/**
- * Hippo Dashboard — local web UI for memory health visualization.
- * Serves a single-page app with memory stats, decay curves, and conflict status.
- *
- * Usage: hippo dashboard [--port 3333]
- */
+/** Hippo dashboard server: the React bundle plus the JSON API behind the Health view and the Board (`hippo dashboard --port`). */
 import * as http from 'http';
-import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
-import { extractPathTags } from './path-context.js';
-import { loadAllEntries, listMemoryConflicts, readEntry, writeEntry } from './store.js';
+import { randomBytes, timingSafeEqual } from 'crypto';
+import { evalNow } from './ablation.js';
+import { readEntry } from './store/entry-reads.js';
 import { listCards } from './store-cards.js';
-import { calculateStrength, confidenceFacets } from './memory.js';
-import { loadConfig } from './config.js';
-import { listPeers } from './shared.js';
-import { loadEmbeddingIndex } from './embeddings.js';
 import { resolveTenantId } from './tenant.js';
 import { loadCardDetail } from './card-detail.js';
-import { isCrossSite, LOOPBACK_HOST_HEADER } from './server.js';
+import { isCrossSite, LOOPBACK_HOST_HEADER } from './http-util.js';
 import { log } from './log.js';
-function buildDashboardData(hippoRoot) {
-    // A5: scope dashboard to active tenant. Without this, the UI surfaces every
-    // tenant's memories on a multi-tenant deployment.
-    const tenantId = resolveTenantId({});
-    const entries = loadAllEntries(hippoRoot, tenantId);
-    const now = new Date();
-    const config = loadConfig(hippoRoot);
-    // v0.28 — fetch ALL conflict statuses (open + resolved) so the UI can
-    // render resolved conflicts as faded historical context, not just open
-    // conflicts. The open_conflicts stat below still counts only 'open' rows
-    // to preserve the existing badge meaning.
-    const conflicts = listMemoryConflicts(hippoRoot, '*', tenantId);
-    // D4 v1.12.10: tenant-scope peer discovery in the dashboard (matches the
-    // tenantId already used for loadAllEntries on line 72).
-    const peers = listPeers(undefined, tenantId);
-    const embeddingIndex = loadEmbeddingIndex(hippoRoot);
-    const embeddedCount = Object.keys(embeddingIndex).length;
-    let totalStrength = 0;
-    let totalHalfLife = 0;
-    let atRisk = 0;
-    let agedOut = 0;
-    const byLayer = {};
-    const byConfidence = {};
-    const memories = entries.map((e) => {
-        const strength = calculateStrength(e, now);
-        const facets = confidenceFacets(e, now);
-        const confidence = facets.tier;
-        const ageDays = (now.getTime() - new Date(e.created).getTime()) / (1000 * 60 * 60 * 24);
-        totalStrength += strength;
-        totalHalfLife += e.half_life_days;
-        if (strength < 0.1 && !e.pinned)
-            atRisk++;
-        byLayer[e.layer] = (byLayer[e.layer] ?? 0) + 1;
-        byConfidence[confidence] = (byConfidence[confidence] ?? 0) + 1;
-        if (facets.agedOut)
-            agedOut++;
-        // Project strength at +7d and +30d
-        const future7 = { ...e, last_retrieved: e.last_retrieved };
-        const future30 = { ...e, last_retrieved: e.last_retrieved };
-        const in7d = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-        const in30d = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000);
-        return {
-            id: e.id,
-            content: e.content,
-            tags: e.tags,
-            layer: e.layer,
-            strength,
-            half_life_days: e.half_life_days,
-            retrieval_count: e.retrieval_count,
-            schema_fit: e.schema_fit,
-            emotional_valence: e.emotional_valence,
-            confidence,
-            aged_out: facets.agedOut,
-            pinned: e.pinned,
-            created: e.created,
-            last_retrieved: e.last_retrieved,
-            age_days: Math.round(ageDays * 10) / 10,
-            projected_strength_7d: calculateStrength(future7, in7d),
-            projected_strength_30d: calculateStrength(future30, in30d),
-            parents: e.parents ?? [],
-            starred: Boolean(e.starred),
-            conflicts_with: e.conflicts_with ?? [],
-        };
-    });
-    return {
-        memories,
-        conflicts: conflicts.map((c) => ({
-            id: c.id,
-            memory_a_id: c.memory_a_id,
-            memory_b_id: c.memory_b_id,
-            reason: c.reason,
-            score: c.score,
-            status: c.status,
-        })),
-        stats: {
-            total: entries.length,
-            pinned: entries.filter((e) => e.pinned).length,
-            errors: entries.filter((e) => e.tags.includes('error')).length,
-            at_risk: atRisk,
-            avg_strength: entries.length > 0 ? totalStrength / entries.length : 0,
-            avg_half_life: entries.length > 0 ? totalHalfLife / entries.length : 0,
-            by_layer: byLayer,
-            by_confidence: byConfidence,
-            aged_out: agedOut,
-            embedding_coverage: entries.length > 0 ? embeddedCount / entries.length : 0,
-            // v0.28 — open_conflicts must count only 'open' rows now that
-            // `conflicts` includes all statuses. Preserves the existing badge
-            // meaning (plan-eng-critic R1 must-fix #2).
-            open_conflicts: conflicts.filter((c) => c.status === 'open').length,
-        },
-        peers,
-        config: {
-            defaultHalfLifeDays: config.defaultHalfLifeDays,
-            defaultBudget: config.defaultBudget,
-            embeddingsEnabled: config.embeddings.enabled,
-            // Every memory captured in the home folder carries these, so they name no project.
-            homePathTags: extractPathTags(os.homedir()),
-        },
-    };
-}
+import { createSnapshotService, isLiveMemory } from './dashboard-snapshot.js';
+import { buildMemoryDetail, buildMemoryPage, buildOverview, buildProjectDetail, buildSearch, } from './dashboard-queries.js';
+import { forgetMemory, markWrong, pinMemory, resolveOpenConflict, } from './dashboard-actions.js';
+import { ParamError, parseActionBody, parseConflictId, parseMemoryId, parseMemoryQuery, parseSearchText, } from './dashboard-params.js';
 const MIME_TYPES = {
     '.html': 'text/html; charset=utf-8',
     '.js': 'application/javascript; charset=utf-8',
@@ -127,8 +22,13 @@ const MIME_TYPES = {
     '.png': 'image/png',
     '.svg': 'image/svg+xml',
     '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
     '.woff2': 'font/woff2',
 };
+const BODY_MAX_BYTES = 4096;
+const BODY_DRAIN_MAX_BYTES = 64 * 1024;
+const JSON_CONTENT_TYPE = /^application\/json\s*(;|$)/i;
+const CARD_ID = /^[A-Za-z0-9_-]+$/;
 function isStaticFileExtension(ext) {
     return Object.hasOwn(MIME_TYPES, ext);
 }
@@ -139,6 +39,13 @@ function jsonResponse(res, data, status = 200) {
     });
     res.end(body);
 }
+function forbidden(res) {
+    res.writeHead(403, { 'Content-Type': 'text/plain' });
+    res.end('Forbidden');
+}
+function notFoundJson(res) {
+    jsonResponse(res, { error: 'Not found' }, 404);
+}
 function serveStaticFile(res, filePath) {
     const ext = path.extname(filePath).toLowerCase();
     if (!isStaticFileExtension(ext))
@@ -156,87 +63,129 @@ function serveStaticFile(res, filePath) {
         return false; // an unreadable asset falls through to the next route, which answers 404 or the fallback page
     }
 }
-export function serveDashboard(hippoRoot, port = 3333) {
-    const distUiDir = path.resolve(import.meta.dirname, '..', 'dist-ui');
-    const hasDistUi = fs.existsSync(path.join(distUiDir, 'index.html'));
-    const handleRequest = (req, res) => {
-        const host = req.headers.host;
-        if (host !== undefined && !LOOPBACK_HOST_HEADER.test(host)) {
-            res.writeHead(403, { 'Content-Type': 'text/plain' });
-            res.end('Forbidden');
-            return;
-        }
-        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
-        const pathname = url.pathname;
-        // --- API routes ---
-        if (pathname.startsWith('/api/')) {
-            // POST /api/star/:id - toggle starred on a memory
-            const starMatch = pathname.match(/^\/api\/star\/([A-Za-z0-9_\-]+)$/);
-            if (starMatch && req.method === 'POST') {
-                if (isCrossSite(req)) {
-                    res.writeHead(403, { 'Content-Type': 'text/plain' });
-                    res.end('Forbidden');
-                    return;
-                }
-                const id = starMatch[1];
-                const entry = readEntry(hippoRoot, id, resolveTenantId({}));
-                if (!entry)
-                    return jsonResponse(res, { error: 'Not found' }, 404);
-                entry.starred = !entry.starred;
-                writeEntry(hippoRoot, entry);
-                return jsonResponse(res, { id, starred: entry.starred });
-            }
-            if (pathname === '/api/cards' && req.method === 'GET') {
-                return jsonResponse(res, { cards: listCards(hippoRoot, resolveTenantId({})) });
-            }
-            const cardMatch = pathname.match(/^\/api\/cards\/([A-Za-z0-9_-]+)$/);
-            if (cardMatch && req.method === 'GET') {
-                const detail = loadCardDetail(hippoRoot, resolveTenantId({}), cardMatch[1]);
-                return detail ? jsonResponse(res, detail) : jsonResponse(res, { error: 'Not found' }, 404);
-            }
-            const data = buildDashboardData(hippoRoot);
-            if (pathname === '/api/memories')
-                return jsonResponse(res, data.memories);
-            if (pathname === '/api/stats')
-                return jsonResponse(res, data.stats);
-            if (pathname === '/api/conflicts')
-                return jsonResponse(res, data.conflicts);
-            if (pathname === '/api/peers')
-                return jsonResponse(res, data.peers);
-            if (pathname === '/api/config')
-                return jsonResponse(res, data.config);
-            if (pathname === '/api/embeddings') {
-                const index = loadEmbeddingIndex(hippoRoot);
-                return jsonResponse(res, index);
+/** Raised once a body passes the drain ceiling; the caller answers 400 and drops the socket. */
+class BodyDrainExceeded extends ParamError {
+}
+// Past the cap it keeps draining so the socket stays usable, up to a ceiling, then refuses.
+function readActionBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        let aborted = false;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size <= BODY_MAX_BYTES)
+                chunks.push(chunk);
+            if (size > BODY_DRAIN_MAX_BYTES && !aborted) {
+                aborted = true;
+                reject(new BodyDrainExceeded(`Body must be at most ${BODY_DRAIN_MAX_BYTES} bytes`));
             }
-            return jsonResponse(res, { error: 'Not found' }, 404);
-        }
-        // --- Static file serving from dist-ui/ ---
-        if (hasDistUi) {
-            // Normalize and prevent path traversal
-            const safePath = path.normalize(pathname).replace(/^(\.\.[/\\])+/, '');
-            const filePath = path.join(distUiDir, safePath);
-            // Block traversal outside dist-ui
-            if (!filePath.startsWith(distUiDir)) {
-                res.writeHead(403, { 'Content-Type': 'text/plain' });
-                res.end('Forbidden');
-                return;
+        });
+        req.on('error', reject);
+        req.on('end', () => {
+            if (size > BODY_MAX_BYTES)
+                return reject(new ParamError(`Body must be at most ${BODY_MAX_BYTES} bytes`));
+            try {
+                resolve(parseActionBody(Buffer.concat(chunks).toString('utf8').trim()));
             }
-            // Try exact file
-            if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
-                if (serveStaticFile(res, filePath))
-                    return;
+            catch (err) {
+                reject(err);
             }
-            // SPA fallback: serve index.html for non-file routes
-            const indexPath = path.join(distUiDir, 'index.html');
-            if (serveStaticFile(res, indexPath))
-                return;
-        }
-        // --- SPA not built: prompt to build (the dashboardHTML SSR fallback
-        // was removed in the hybrid-v4 revamp E1 since dist-ui/ is now the
-        // sole UI surface). ---
-        res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
-        res.end(`<!doctype html>
+        });
+    });
+}
+function sendOrNotFound(res, body) {
+    if (body === null)
+        notFoundJson(res);
+    else
+        jsonResponse(res, body);
+    return true;
+}
+function handleRead(ctx, segments) {
+    const { hippoRoot, snapshots, req, res, url } = ctx;
+    const tenantId = resolveTenantId({});
+    // A cross-site <img src=...?fresh=1> must not force a full rebuild.
+    const fresh = url.searchParams.get('fresh') === '1' && !isCrossSite(req);
+    const [, head, a, b] = segments;
+    if (head === 'overview' && segments.length === 2) {
+        return sendOrNotFound(res, buildOverview(snapshots.get(tenantId, fresh)));
+    }
+    if (head === 'projects' && a !== undefined && segments.length === 4 && b === 'memories') {
+        const query = parseMemoryQuery(url.searchParams);
+        return sendOrNotFound(res, buildMemoryPage(snapshots.get(tenantId, fresh), a, query));
+    }
+    if (head === 'projects' && a !== undefined && segments.length === 3) {
+        return sendOrNotFound(res, buildProjectDetail(snapshots.get(tenantId, fresh), a));
+    }
+    if (head === 'memory' && a !== undefined && segments.length === 3) {
+        const entry = readEntry(hippoRoot, parseMemoryId(a), tenantId);
+        if (entry === null || !isLiveMemory(entry))
+            return sendOrNotFound(res, null);
+        const snapshotId = snapshots.get(tenantId, fresh).id;
+        const embedded = snapshots.embeddedIds()?.has(entry.id) ?? false;
+        return sendOrNotFound(res, buildMemoryDetail(hippoRoot, tenantId, entry, snapshotId, ctx.now(), embedded));
+    }
+    if (head === 'search' && segments.length === 2) {
+        return sendOrNotFound(res, buildSearch(snapshots.get(tenantId, fresh), parseSearchText(url.searchParams)));
+    }
+    if (head === 'cards' && segments.length === 2) {
+        return sendOrNotFound(res, { cards: listCards(hippoRoot, tenantId) });
+    }
+    if (head === 'cards' && a !== undefined && segments.length === 3) {
+        // The Board has always answered 404, not 400, for an id that does not fit the pattern.
+        return sendOrNotFound(res, CARD_ID.test(a) ? loadCardDetail(hippoRoot, tenantId, a) ?? null : null);
+    }
+    return false;
+}
+// Names the action only; nothing runs until the cross-site, content-type and body guards pass.
+function matchAction(segments) {
+    const [, head, id, verb] = segments;
+    if (segments.length !== 4 || id === undefined)
+        return null;
+    if (head === 'memory' && verb === 'pin')
+        return (root, tenant, body) => pinMemory(root, tenant, id, body);
+    if (head === 'memory' && verb === 'wrong')
+        return (root, tenant) => markWrong(root, tenant, id);
+    if (head === 'memory' && verb === 'forget')
+        return (root, tenant) => forgetMemory(root, tenant, id);
+    if (head === 'conflicts' && verb === 'resolve') {
+        return (root, tenant, body) => resolveOpenConflict(root, tenant, parseConflictId(id), body);
+    }
+    return null;
+}
+async function handlePost(ctx, segments) {
+    const action = matchAction(segments);
+    if (action === null)
+        return false;
+    const { req, res, hippoRoot, snapshots } = ctx;
+    if (isCrossSite(req)) {
+        forbidden(res);
+        return true;
+    }
+    if (!JSON_CONTENT_TYPE.test(req.headers['content-type'] ?? '')) {
+        jsonResponse(res, { error: 'Content-Type must be application/json' }, 415);
+        req.resume();
+        return true;
+    }
+    const body = await readActionBody(req);
+    const tenantId = resolveTenantId({});
+    const result = action(hippoRoot, tenantId, body);
+    if (result.changed)
+        snapshots.invalidate();
+    if (result.entry) {
+        // The write is committed, so a rebuild failure must not turn it into a 500: the next read rebuilds.
+        const embedded = snapshots.embeddedIds()?.has(result.entry.id) ?? false;
+        const detail = buildMemoryDetail(hippoRoot, tenantId, result.entry, snapshots.currentId(), ctx.now(), embedded);
+        jsonResponse(res, detail, result.status);
+    }
+    else {
+        jsonResponse(res, result.body, result.status);
+    }
+    return true;
+}
+function notBuilt(res) {
+    res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(`<!doctype html>
 <html lang="en"><head><title>Hippo Dashboard</title><meta charset="utf-8"></head>
 <body style="font-family:Georgia,'Palatino Linotype',serif;max-width:640px;margin:60px auto;padding:24px;line-height:1.6;background:#f4efe6;color:#3a3228">
 <h1 style="color:#c45c3c">Hippo Dashboard</h1>
@@ -244,22 +193,99 @@ export function serveDashboard(hippoRoot, port = 3333) {
 <pre style="background:#faf7f2;padding:16px;border:1px solid #c4b9a8;border-radius:3px;font-family:Consolas,monospace">cd ui && npm install && npm run build</pre>
 <p>Then refresh this page. The dashboard server will serve <code>dist-ui/index.html</code> automatically once present.</p>
 </body></html>`);
+}
+function serveSpa(res, distUiDir, pathname) {
+    const safePath = path.normalize(pathname).replace(/^(\.\.[/\\])+/, '');
+    const filePath = path.join(distUiDir, safePath);
+    if (!filePath.startsWith(distUiDir))
+        return forbidden(res);
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile() && serveStaticFile(res, filePath))
+        return;
+    // SPA fallback: non-file routes get index.html.
+    if (serveStaticFile(res, path.join(distUiDir, 'index.html')))
+        return;
+    notBuilt(res);
+}
+function sameToken(given, token) {
+    if (given === undefined)
+        return false;
+    const a = Buffer.from(given);
+    const b = Buffer.from(token);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function cookieValue(header, name) {
+    for (const part of (header ?? '').split(';')) {
+        const eq = part.indexOf('=');
+        if (eq > 0 && part.slice(0, eq).trim() === name)
+            return part.slice(eq + 1).trim();
+    }
+    return undefined;
+}
+/** Serves the dashboard on 127.0.0.1 behind a per-start `token` (tests pass one), since loopback alone lets any local process read every memory; `opts` sets the projection and cache clocks. */
+export function serveDashboard(hippoRoot, port = 3333, token = randomBytes(32).toString('base64url'), opts) {
+    const distUiDir = path.resolve(import.meta.dirname, '..', 'dist-ui');
+    const hasDistUi = fs.existsSync(path.join(distUiDir, 'index.html'));
+    const now = opts?.now ?? (() => evalNow().getTime());
+    const snapshots = createSnapshotService(hippoRoot, now, opts?.cacheClock);
+    const handleRequest = async (req, res) => {
+        const host = req.headers.host;
+        if (host !== undefined && !LOOPBACK_HOST_HEADER.test(host))
+            return forbidden(res);
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        // Cookies ignore the port, so the name carries it: two dashboards on one host keep separate tokens.
+        const cookieName = `hippo_dashboard_${req.socket.localPort ?? port}`;
+        if (sameToken(url.searchParams.get('token') ?? undefined, token)) {
+            res.setHeader('Set-Cookie', `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`);
+        }
+        else if (!sameToken(cookieValue(req.headers.cookie, cookieName), token)) {
+            res.writeHead(401, { 'Content-Type': 'text/plain' });
+            res.end('Unauthorized: open the dashboard with the URL `hippo dashboard` printed; it carries the access token.');
+            return;
+        }
+        if (url.pathname.startsWith('/api/')) {
+            // A malformed % sequence throws URIError here; the caller answers 400.
+            const segments = url.pathname.split('/').filter((s) => s !== '').map((s) => decodeURIComponent(s));
+            const ctx = { hippoRoot, snapshots, now, req, res, url };
+            const handled = req.method === 'GET' ? handleRead(ctx, segments)
+                : req.method === 'POST' ? await handlePost(ctx, segments)
+                    : false;
+            if (!handled)
+                notFoundJson(res);
+            return;
+        }
+        if (hasDistUi)
+            return serveSpa(res, distUiDir, url.pathname);
+        notBuilt(res);
     };
     const server = http.createServer((req, res) => {
-        try {
-            handleRequest(req, res);
-        }
-        catch (err) {
-            log.error(`dashboard request failed: ${err instanceof Error ? err.message : String(err)}`);
-            if (res.headersSent)
+        handleRequest(req, res).catch((err) => {
+            const clientFault = err instanceof ParamError || err instanceof URIError;
+            // A cut-short response is logged even for a client fault; a bare 400 is not.
+            if (res.headersSent || !clientFault) {
+                log.error('dashboard request failed', { error: err instanceof Error ? err.message : String(err), path: req.url });
+            }
+            if (res.headersSent) {
                 res.end();
-            else
-                jsonResponse(res, { error: 'Internal error' }, 500);
-        }
+                return;
+            }
+            if (err instanceof BodyDrainExceeded) {
+                res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8', Connection: 'close' });
+                res.end(JSON.stringify({ error: err.message }), () => req.destroy());
+                return;
+            }
+            if (err instanceof ParamError)
+                return jsonResponse(res, { error: err.message }, 400);
+            if (err instanceof URIError)
+                return jsonResponse(res, { error: 'Malformed URL path' }, 400);
+            jsonResponse(res, { error: 'Internal error' }, 500);
+        });
     });
+    server.on('close', () => snapshots.close());
     server.listen(port, '127.0.0.1', () => {
+        // SAFETY: listen() was given a TCP port, so address() is AddressInfo, never a pipe name.
+        const boundPort = server.address().port;
         // The banner is the `hippo dashboard` command's printed result, so it stays on stdout.
-        console.log(`Hippo Dashboard running at http://localhost:${port}`);
+        console.log(`Hippo Dashboard running at http://localhost:${boundPort}/?token=${token}`);
         if (hasDistUi)
             console.log(`Serving React UI from ${distUiDir}`);
         console.log('Press Ctrl+C to stop.');

package/dist/db/busy.d.ts

@@ -0,0 +1,5 @@
+import type { DatabaseSyncLike } from './sqlite.js';
+export declare function isSqliteBusy(error: unknown): boolean;
+export declare const STORE_BUSY_MESSAGE = "store busy (another hippo process holds the write lock); retry shortly";
+export declare function execWithBusyRetry(db: DatabaseSyncLike, sql: string, timeoutMs?: number): void;
+//# sourceMappingURL=busy.d.ts.map

package/dist/db/busy.js

@@ -0,0 +1,24 @@
+export function isSqliteBusy(error) {
+    const code = error?.errcode;
+    return code === 5 || code === 6 || code === 517;
+}
+export const STORE_BUSY_MESSAGE = 'store busy (another hippo process holds the write lock); retry shortly';
+// busy_timeout covers neither of this file's two contended statements: SQLite
+// skips the busy handler for `PRAGMA journal_mode` and for a write that upgrades
+// a deferred read snapshot. Both need an explicit wait instead.
+export function execWithBusyRetry(db, sql, timeoutMs = 30000) {
+    const deadline = Date.now() + timeoutMs;
+    const idle = new Int32Array(new SharedArrayBuffer(4));
+    for (;;) {
+        try {
+            db.exec(sql);
+            return;
+        }
+        catch (error) {
+            if (!isSqliteBusy(error) || Date.now() >= deadline)
+                throw error;
+            Atomics.wait(idle, 0, 0, 10 + Math.floor(Math.random() * 20));
+        }
+    }
+}
+//# sourceMappingURL=busy.js.map

package/dist/db/continuity.d.ts

@@ -0,0 +1,5 @@
+import type { DatabaseSyncLike } from './sqlite.js';
+export declare const MEMORY_QUARANTINE_DDL = "\n    CREATE TABLE IF NOT EXISTS memory_quarantine (\n      tenant_id      TEXT NOT NULL DEFAULT 'default',\n      memory_id      TEXT NOT NULL,\n      original_scope TEXT,\n      reason         TEXT NOT NULL,\n      status         TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected')),\n      quarantined_at TEXT NOT NULL,\n      decided_at     TEXT,\n      decided_by     TEXT,\n      PRIMARY KEY (tenant_id, memory_id)\n    ) WITHOUT ROWID;\n    CREATE INDEX IF NOT EXISTS idx_memory_quarantine_status\n      ON memory_quarantine(tenant_id, status, quarantined_at DESC);\n";
+export declare function ensureContinuityTables(db: DatabaseSyncLike): void;
+export declare function ensureContinuityIndexes(db: DatabaseSyncLike): void;
+//# sourceMappingURL=continuity.d.ts.map

package/dist/db/continuity.js

@@ -0,0 +1,145 @@
+// Shared by migration v48 and the stamped-store self-heal below.
+export const MEMORY_QUARANTINE_DDL = `
+    CREATE TABLE IF NOT EXISTS memory_quarantine (
+      tenant_id      TEXT NOT NULL DEFAULT 'default',
+      memory_id      TEXT NOT NULL,
+      original_scope TEXT,
+      reason         TEXT NOT NULL,
+      status         TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected')),
+      quarantined_at TEXT NOT NULL,
+      decided_at     TEXT,
+      decided_by     TEXT,
+      PRIMARY KEY (tenant_id, memory_id)
+    ) WITHOUT ROWID;
+    CREATE INDEX IF NOT EXISTS idx_memory_quarantine_status
+      ON memory_quarantine(tenant_id, status, quarantined_at DESC);
+`;
+const TASK_SNAPSHOTS_DDL = `
+    CREATE TABLE IF NOT EXISTS task_snapshots (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      task TEXT NOT NULL,
+      summary TEXT NOT NULL,
+      next_step TEXT NOT NULL,
+      status TEXT NOT NULL,
+      source TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      session_id TEXT,
+      tenant_id TEXT NOT NULL DEFAULT 'default',
+      scope TEXT
+    )
+  `;
+const SESSION_EVENTS_DDL = `
+    CREATE TABLE IF NOT EXISTS session_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      session_id TEXT NOT NULL,
+      task TEXT,
+      event_type TEXT NOT NULL,
+      content TEXT NOT NULL,
+      source TEXT NOT NULL,
+      metadata_json TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      tenant_id TEXT NOT NULL DEFAULT 'default',
+      scope TEXT
+    )
+  `;
+const SESSION_HANDOFFS_DDL = `
+    CREATE TABLE IF NOT EXISTS session_handoffs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      session_id TEXT NOT NULL,
+      repo_root TEXT,
+      task_id TEXT,
+      summary TEXT NOT NULL,
+      next_action TEXT,
+      artifacts_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL,
+      tenant_id TEXT NOT NULL DEFAULT 'default',
+      scope TEXT,
+      constraints_json TEXT,
+      evidence_json TEXT,
+      outcome TEXT,
+      target_runtime TEXT,
+      card_id TEXT
+    )
+  `;
+const CARDS_DDL = `
+    CREATE TABLE IF NOT EXISTS cards (
+      id TEXT PRIMARY KEY,
+      title TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'backlog',
+      assignee_runtime TEXT,
+      repo TEXT,
+      contract TEXT,
+      budget INTEGER,
+      lease_until TEXT,
+      heartbeat_at TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      tenant_id TEXT NOT NULL DEFAULT 'default',
+      scope TEXT
+    ) WITHOUT ROWID
+  `;
+const CARD_DEPS_DDL = `
+    CREATE TABLE IF NOT EXISTS card_deps (
+      parent TEXT NOT NULL REFERENCES cards(id),
+      child TEXT NOT NULL REFERENCES cards(id),
+      tenant_id TEXT NOT NULL DEFAULT 'default',
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (parent, child)
+    ) WITHOUT ROWID
+  `;
+const CARD_RUNS_DDL = `
+    CREATE TABLE IF NOT EXISTS card_runs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      card TEXT NOT NULL REFERENCES cards(id),
+      runtime TEXT NOT NULL,
+      session_id TEXT,
+      started TEXT NOT NULL,
+      ended TEXT,
+      outcome TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      tenant_id TEXT NOT NULL DEFAULT 'default'
+    )
+  `;
+const CARD_COMMENTS_DDL = `
+    CREATE TABLE IF NOT EXISTS card_comments (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      card_id TEXT NOT NULL REFERENCES cards(id),
+      author TEXT NOT NULL,
+      body TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      tenant_id TEXT NOT NULL DEFAULT 'default'
+    )
+  `;
+// Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
+// incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
+export function ensureContinuityTables(db) {
+    db.exec(TASK_SNAPSHOTS_DDL);
+    db.exec(SESSION_EVENTS_DDL);
+    db.exec(SESSION_HANDOFFS_DDL);
+    db.exec(CARDS_DDL);
+    db.exec(CARD_DEPS_DDL);
+    db.exec(CARD_RUNS_DDL);
+    db.exec(CARD_COMMENTS_DDL);
+    db.exec(MEMORY_QUARANTINE_DDL);
+}
+// After the loop: tenant_id (v16) and scope (v23) do not exist yet on a genuine old store.
+export function ensureContinuityIndexes(db) {
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_status_updated ON task_snapshots(status, updated_at DESC, id DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_status ON task_snapshots(tenant_id, status, updated_at DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_scope ON task_snapshots(tenant_id, scope, status)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_session_created ON session_events(session_id, created_at DESC, id DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_task_created ON session_events(task, created_at DESC, id DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_session ON session_handoffs(session_id, created_at DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_outcome ON session_handoffs(tenant_id, outcome, created_at DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_cards_tenant_status ON cards(tenant_id, status, updated_at DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_child ON card_deps(tenant_id, child)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_parent ON card_deps(tenant_id, parent)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_runs_tenant_card ON card_runs(tenant_id, card, started DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_comments_tenant_card ON card_comments(tenant_id, card_id, created_at DESC)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_card ON session_handoffs(tenant_id, card_id, created_at DESC)`);
+}
+//# sourceMappingURL=continuity.js.map