hippo-memory 1.61.0 → 1.63.0

package/dist/api/remember.d.ts

@@ -10,14 +10,14 @@ export interface RememberOpts {
     tags?: string[];
     /**
      * Optional hook invoked inside the same transaction as the underlying
-     * memories INSERT. Used by ingestion connectors (E1.3+) to stamp
+     * memories INSERT. Used by ingestion connectors to stamp
      * idempotency / cursor rows atomically with the memory row, so a crash
      * mid-write cannot produce a memory without its corresponding side-effect
      * log row (or vice versa). If the callback throws, the INSERT is rolled
      * back and the error is rethrown.
      */
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
-    /** CD5: connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
+    /** Connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
     untrusted?: boolean;
 }
 export interface RememberResult {

package/dist/api/sleep.d.ts

@@ -64,22 +64,21 @@ export interface SleepResult {
     };
     shared?: number;
     /**
-     * v1.25.0: count of memories the auto-share secret veto withheld this sleep
+     * Count of memories the auto-share secret veto withheld this sleep
      * — rows that passed every other admission gate (transfer score,
      * not-already-global) and were blocked solely by `detectSecret`. Absent
      * when 0 or when auto-share did not run.
      */
     secretSkipped?: number;
     /**
-     * AT1: count of auto-share candidates the GLOBAL store's rejection
-     * tombstone refused this sleep (docs/plans/2026-08-15-at1-rejected-value-tombstone.md
-     * plan §3 — copy paths must not let one rejected candidate abort the
-     * batch). Absent when 0 or when auto-share did not run.
+     * Count of auto-share candidates the GLOBAL store's rejection
+     * tombstone refused this sleep; copy paths must not let one rejected
+     * candidate abort the batch. Absent when 0 or when auto-share did not run.
      */
     rejectedSkipped?: number;
     ambient?: AmbientState | null;
     /**
-     * E3 sleep enqueue-hook: graph re-extraction totals across the tenants rebuilt
+     * Graph re-extraction totals across the tenants rebuilt
      * this sleep. Absent when no tenant was dirty, and under dryRun (the graph
      * phase runs only on a real sleep). Cross-tenant aggregate, one reason
      * /v1/sleep stays loopback-only.
@@ -91,35 +90,7 @@ export interface SleepResult {
     };
     details?: string[];
 }
-/**
- * Run the pure-storage consolidation pipeline.
- *
- * Tenant scope note: sleep operates on the WHOLE hippoRoot (all tenants in
- * it), matching the pre-refactor cmdSleepCore behavior. Correct for a CLI
- * maintenance op invoked by the operator. Episode B (v1.11.4) exposed this
- * over HTTP `/v1/sleep` with loopback-only enforcement (per-request guard
- * in the handler plus serve()'s boot-time host check). The TODOS.md
- * per-tenant scoping follow-up remains open for the day non-loopback
- * serving lands — at that point the route will need an admin-role gate OR
- * api.sleep itself will need to scope dedup / audit / delete by ctx.tenantId.
- *
- * Dedup and audit deletes each log a `forget` row with the ctx actor and a
- * `metadata.reason`. Pinned, raw, kept and object-backing rows are never auto-deleted (AUTOMATIC_DELETE_SQL).
- * dryRun previews consolidate, dedup and audit, then returns before share/ambient.
- */
-/**
- * v1.12.2: Test-only DI seam shape for `sleep`'s phase dependencies.
- *
- * Each field defaults to the real production implementation imported at the
- * top of this file. Test files pass a `Partial<SleepPhases>` override via
- * `SleepOpts.__phases` (note the `__` prefix — internal-only) to inject
- * deterministic throws for mid-phase failure-path coverage (the
- * `partial: true` + `errorMessage` audit-row branch at line ~2098).
- *
- * Production callers MUST NOT use `__phases`. The field exists solely so
- * `tests/api-sleep-phase-faults.test.ts` can force each phase boundary to
- * throw without depending on store-corruption fragility.
- */
+/** Test-only seam: `SleepOpts.__phases` forces a phase to throw into emitSleepAudit's `partial: true` row; production never sets it. */
 export interface SleepPhases {
     consolidate: typeof consolidate;
     deduplicateStore: typeof deduplicateStore;
@@ -132,5 +103,6 @@ export interface SleepPhases {
     loadPendingExtractionTenants: typeof loadPendingExtractionTenants;
     extractGraph: typeof extractGraph;
 }
+/** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; never auto-deletes pinned, raw, kept or object-backing rows. */
 export declare function sleep(ctx: Context, opts?: SleepOpts): Promise<SleepResult>;
 //# sourceMappingURL=sleep.d.ts.map

package/dist/api/sleep.js

@@ -23,192 +23,19 @@ const DEFAULT_SLEEP_PHASES = {
     loadPendingExtractionTenants,
     extractGraph,
 };
+/** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; never auto-deletes pinned, raw, kept or object-backing rows. */
 export async function sleep(ctx, opts = {}) {
     const dryRun = Boolean(opts.dryRun);
-    // v1.12.2: resolve phase dependencies, allowing test-only `__phases`
+    // Resolve phase dependencies, allowing test-only `__phases`
     // override to inject deterministic throws for mid-phase failure coverage.
     const phases = { ...DEFAULT_SLEEP_PHASES, ...(opts.__phases ?? {}) };
-    // v1.11.5: phase counters for the consolidate audit emit (in finally).
+    // Phase counters for the consolidate audit emit (in finally).
     // Accumulated as each phase completes so partial-failure paths still report
     // accurate "what got done before the failure" data.
-    let consolidationCount = 0;
-    let dedupCount = 0;
-    let auditDeletedCount = 0;
-    let ambientTotal = 0;
+    const counts = { consolidation: 0, dedup: 0, auditDeleted: 0, ambient: 0 };
     let phaseError = null;
-    let graphSnapshotError = null;
-    let result = null;
     try {
-        // Snapshot dirty tenants BEFORE any memory-deleting phase (consolidate /
-        // dedup / audit). The graph_extraction_queue rows are FK'd to mirror
-        // memories with ON DELETE CASCADE, so a phase that deletes a queued mirror
-        // (e.g. dedup removing a near-duplicate superseding decision) would drop the
-        // tenant from a drain-time load and leave its graph stale (codex P1). The
-        // MAX(id) watermark captured here stays valid: arrivals during sleep get a
-        // higher id and remain pending.
-        //
-        // Fail-soft (codex P2): a queue-read failure here must NOT abort core sleep
-        // (consolidation / dedup / audit run regardless). On failure, skip graph
-        // refresh this sleep (recovered next sleep) and surface a detail once
-        // `result` exists (Phase 6).
-        let dirtyTenants = [];
-        if (!dryRun) {
-            try {
-                dirtyTenants = phases.loadPendingExtractionTenants(ctx.hippoRoot);
-            }
-            catch (snapErr) {
-                // SAFETY: this is a best-effort log message only; property access on
-                // any JS value is safe (undefined if absent), preserving the existing
-                // lenient formatting even when something non-Error was thrown.
-                graphSnapshotError = snapErr.message;
-            }
-        }
-        // Phase 1: Consolidation.
-        const consolidateResult = await phases.consolidate(ctx.hippoRoot, { dryRun });
-        consolidationCount = consolidateResult.semanticCreated + consolidateResult.merged;
-        result = {
-            active: consolidateResult.decayed,
-            removed: consolidateResult.removed,
-            mergedEpisodic: consolidateResult.merged,
-            newSemantic: consolidateResult.semanticCreated,
-            dryRun,
-            details: consolidateResult.details,
-        };
-        // Set only when non-zero, so a store without dormant memories gets a
-        // byte-identical result (HTTP /v1/sleep, the CLI render snapshot).
-        if (consolidateResult.dormant > 0) {
-            result.dormant = consolidateResult.dormant;
-        }
-        if (consolidateResult.dormantExpired > 0) {
-            result.dormantExpired = consolidateResult.dormantExpired;
-        }
-        // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
-        const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject });
-        dedupCount = dedupResult.removed;
-        if (dedupResult.removed > 0) {
-            const semDups = dedupResult.pairs.filter((p) => p.keptLayer === 'semantic' && p.removedLayer === 'semantic').length;
-            const epiDups = dedupResult.pairs.filter((p) => p.keptLayer === 'episodic' && p.removedLayer === 'episodic').length;
-            const crossDups = dedupResult.pairs.filter((p) => p.keptLayer !== p.removedLayer).length;
-            result.deduped = {
-                removed: dedupResult.removed,
-                semDups,
-                epiDups,
-                crossDups,
-            };
-        }
-        // Phase 3: Quality audit (remove junk, report warnings; a dry run skips rows earlier phases would remove).
-        const planned = new Set(dryRun ? [...(consolidateResult.removedIds ?? []), ...dedupResult.pairs.map((p) => p.removed)] : []);
-        const allEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !planned.has(e.id));
-        const auditOut = phases.auditMemories(allEntries, memoriesBackingObjects(ctx.hippoRoot));
-        if (auditOut.issues.length > 0) {
-            const errors = auditOut.issues.filter((i) => i.severity === 'error');
-            const warnings = auditOut.issues.filter((i) => i.severity === 'warning');
-            let removed = 0;
-            for (const issue of errors) {
-                const reason = `sleep-audit: ${issue.reason}`;
-                if (dryRun || phases.deleteEntry(ctx.hippoRoot, issue.memoryId, { actor: ctx.actor.subject, reason, automatic: true }))
-                    removed++;
-            }
-            auditDeletedCount = removed;
-            if (removed > 0 || warnings.length > 0) {
-                result.audit = {
-                    errorsRemoved: removed,
-                    warningCount: warnings.length,
-                };
-            }
-        }
-        if (dryRun)
-            return result;
-        // Phase 4: Auto-share high-transfer-score memories to global.
-        if (!opts.noShare) {
-            const sleepConfig = phases.loadConfig(ctx.hippoRoot);
-            if (sleepConfig.autoShareOnSleep) {
-                // v1.25.0: surface the secret-veto skip count (v39 follow-up #2) so
-                // the veto is observable instead of silent.
-                // AT1: rejectedSkipped is autoShare's sibling counter for candidates
-                // the global store's rejection tombstone refused (threaded the same
-                // way as secretSkipped just below).
-                const autoShareStats = { secretSkipped: 0, rejectedSkipped: 0 };
-                const shared = phases.autoShare(ctx.hippoRoot, { minScore: 0.6, stats: autoShareStats });
-                if (shared.length > 0) {
-                    result.shared = shared.length;
-                }
-                if (autoShareStats.secretSkipped > 0) {
-                    result.secretSkipped = autoShareStats.secretSkipped;
-                }
-                if (autoShareStats.rejectedSkipped > 0) {
-                    result.rejectedSkipped = autoShareStats.rejectedSkipped;
-                }
-            }
-        }
-        // Phase 5: Post-sleep ambient state summary.
-        const postSleepConfig = phases.loadConfig(ctx.hippoRoot);
-        if (postSleepConfig.ambient.enabled) {
-            const postSleepEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !e.superseded_by);
-            if (postSleepEntries.length > 0) {
-                result.ambient = phases.computeAmbientState(postSleepEntries);
-                ambientTotal = result.ambient.totalMemories;
-            }
-        }
-        // Phase 6: Graph extraction drain (E3 sleep enqueue-hook). Rebuild the
-        // entity/relation graph for every tenant marked dirty (by markGraphDirty)
-        // since the last sleep, so `recall --hops` + cross-object `references` edges
-        // run on fresh data without a manual `hippo graph extract`. Fully
-        // fault-isolated: the consolidation work above has already committed, so a
-        // failure here must never abort sleep; a per-tenant extract failure leaves
-        // that tenant's queue items pending for the next sleep. (Skipped under
-        // dryRun via the early return above.)
-        try {
-            if (graphSnapshotError) {
-                // The dirty-tenant snapshot failed (codex P2 fail-soft). Core sleep
-                // already succeeded; surface the skipped graph refresh as a detail.
-                result.details = [
-                    ...(result.details ?? []),
-                    `graph: dirty-tenant snapshot failed (skipped graph refresh): ${graphSnapshotError}`,
-                ];
-            }
-            let gTenants = 0;
-            let gEntities = 0;
-            let gRelations = 0;
-            // dirtyTenants was snapshotted before the memory-deleting phases above.
-            for (const { tenantId, maxPendingId } of dirtyTenants) {
-                try {
-                    const ext = phases.extractGraph(ctx.hippoRoot, tenantId);
-                    // Count the rebuild as soon as it succeeds — it happened regardless of
-                    // the drain-mark below.
-                    gTenants += 1;
-                    gEntities += ext.entities;
-                    gRelations += ext.relations;
-                    // Watermark drain: mark processed only items enqueued before this
-                    // rebuild started (id <= maxPendingId). Arrivals during the rebuild
-                    // keep pending status and are caught next sleep; rows whose mirror was
-                    // cascade-deleted earlier this sleep are already gone (no-op).
-                    markPendingProcessedUpTo(ctx.hippoRoot, tenantId, maxPendingId);
-                }
-                catch (tenantErr) {
-                    // SAFETY: this is a best-effort log message only; property access
-                    // on any JS value is safe (undefined if absent), preserving the
-                    // existing lenient formatting even when something non-Error was thrown.
-                    result.details = [
-                        ...(result.details ?? []),
-                        `graph: extract failed for a dirty tenant (left pending): ${tenantErr.message}`,
-                    ];
-                }
-            }
-            if (gTenants > 0) {
-                result.graph = { tenants: gTenants, entities: gEntities, relations: gRelations };
-            }
-        }
-        catch (graphErr) {
-            // SAFETY: this is a best-effort log message only; property access on
-            // any JS value is safe (undefined if absent), preserving the existing
-            // lenient formatting even when something non-Error was thrown.
-            result.details = [
-                ...(result.details ?? []),
-                `graph: drain phase failed (skipped): ${graphErr.message}`,
-            ];
-        }
-        return result;
+        return await runSleepPhases(ctx, opts, phases, counts);
     }
     catch (err) {
         // SAFETY: phaseError is read via phaseError.message / (phaseError !==
@@ -218,54 +45,213 @@ export async function sleep(ctx, opts = {}) {
         throw err;
     }
     finally {
-        // v1.11.5: emit one 'consolidate' audit_log row per api.sleep invocation,
-        // with phase counters in metadata. Closes the CLI/MCP parity gap that T6
-        // fixed for cmdOutcome (Episode A follow-up). In finally so partial-failure
-        // paths still emit; `partial: true` + errorMessage flag the failure.
-        // Dedicated handle for this emit only (phase helpers above each open their
-        // own handle via hippoRoot — SQLite single-writer makes parallel handles
-        // safe for the read-heavy phases).
-        //
-        // TODO(v1.12.0 + A5 v2): the audit row is tagged with ctx.tenantId but
-        // api.sleep is host-wide (cross-tenant dedup is intentional). When
-        // /v1/sleep moves off loopback-only, either tag with a synthetic "host"
-        // tenant or scope api.sleep per-tenant. Independent-review-critic flag,
-        // v1.11.5 ship.
-        //
-        // Error preservation: if openHippoDb or appendAuditEvent throws here, we
-        // do NOT let it replace the original phaseError (independent-review HIGH:
-        // would mask the underlying consolidation failure). Audit emit failure
-        // is logged to stderr but the original throw wins.
+        emitSleepAudit(ctx, opts, dryRun, counts, phaseError);
+    }
+}
+async function runSleepPhases(ctx, opts, phases, counts) {
+    const dryRun = Boolean(opts.dryRun);
+    const snapshot = snapshotDirtyTenants(ctx, phases, dryRun);
+    // Phase 1: Consolidation.
+    const consolidateResult = await phases.consolidate(ctx.hippoRoot, { dryRun });
+    counts.consolidation = consolidateResult.semanticCreated + consolidateResult.merged;
+    const result = sleepResultFrom(consolidateResult, dryRun);
+    // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
+    const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject });
+    counts.dedup = dedupResult.removed;
+    if (dedupResult.removed > 0)
+        result.deduped = dedupSummary(dedupResult);
+    // Phase 3: Quality audit (remove junk, report warnings; a dry run skips rows earlier phases would remove).
+    counts.auditDeleted = runQualityAudit(ctx, phases, dryRun, consolidateResult, dedupResult, result);
+    if (dryRun)
+        return result;
+    // Phase 4: Auto-share high-transfer-score memories to global.
+    if (!opts.noShare)
+        shareOnSleep(ctx, phases, result);
+    // Phase 5: Post-sleep ambient state summary.
+    counts.ambient = summarizeAmbient(ctx, phases, result);
+    drainGraphQueue(ctx, phases, snapshot, result);
+    return result;
+}
+// Taken before any memory-deleting phase: queue rows cascade-delete with their mirror, so a later read would miss
+// tenants dedup touched. Fail-soft: a failed read skips the graph refresh this sleep and never aborts core sleep.
+function snapshotDirtyTenants(ctx, phases, dryRun) {
+    const snapshot = { dirtyTenants: [], error: null };
+    if (!dryRun) {
         try {
-            const db = openHippoDb(ctx.hippoRoot);
+            snapshot.dirtyTenants = phases.loadPendingExtractionTenants(ctx.hippoRoot);
+        }
+        catch (snapErr) {
+            // SAFETY: this is a best-effort log message only; property access on
+            // any JS value is safe (undefined if absent), preserving the existing
+            // lenient formatting even when something non-Error was thrown.
+            snapshot.error = snapErr.message;
+        }
+    }
+    return snapshot;
+}
+function sleepResultFrom(consolidateResult, dryRun) {
+    const result = {
+        active: consolidateResult.decayed,
+        removed: consolidateResult.removed,
+        mergedEpisodic: consolidateResult.merged,
+        newSemantic: consolidateResult.semanticCreated,
+        dryRun,
+        details: consolidateResult.details,
+    };
+    // Set only when non-zero, so a store without dormant memories gets a
+    // byte-identical result (HTTP /v1/sleep, the CLI render snapshot).
+    if (consolidateResult.dormant > 0) {
+        result.dormant = consolidateResult.dormant;
+    }
+    if (consolidateResult.dormantExpired > 0) {
+        result.dormantExpired = consolidateResult.dormantExpired;
+    }
+    return result;
+}
+function dedupSummary(dedupResult) {
+    const semDups = dedupResult.pairs.filter((p) => p.keptLayer === 'semantic' && p.removedLayer === 'semantic').length;
+    const epiDups = dedupResult.pairs.filter((p) => p.keptLayer === 'episodic' && p.removedLayer === 'episodic').length;
+    const crossDups = dedupResult.pairs.filter((p) => p.keptLayer !== p.removedLayer).length;
+    return {
+        removed: dedupResult.removed,
+        semDups,
+        epiDups,
+        crossDups,
+    };
+}
+/** Returns how many audit errors were deleted, or would be under dryRun. */
+function runQualityAudit(ctx, phases, dryRun, consolidateResult, dedupResult, result) {
+    const planned = new Set(dryRun ? [...(consolidateResult.removedIds ?? []), ...dedupResult.pairs.map((p) => p.removed)] : []);
+    const allEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !planned.has(e.id));
+    const auditOut = phases.auditMemories(allEntries, memoriesBackingObjects(ctx.hippoRoot));
+    if (auditOut.issues.length === 0)
+        return 0;
+    const errors = auditOut.issues.filter((i) => i.severity === 'error');
+    const warnings = auditOut.issues.filter((i) => i.severity === 'warning');
+    let removed = 0;
+    for (const issue of errors) {
+        const reason = `sleep-audit: ${issue.reason}`;
+        if (dryRun || phases.deleteEntry(ctx.hippoRoot, issue.memoryId, { actor: ctx.actor.subject, reason, automatic: true }))
+            removed++;
+    }
+    if (removed > 0 || warnings.length > 0) {
+        result.audit = {
+            errorsRemoved: removed,
+            warningCount: warnings.length,
+        };
+    }
+    return removed;
+}
+function shareOnSleep(ctx, phases, result) {
+    const sleepConfig = phases.loadConfig(ctx.hippoRoot);
+    if (!sleepConfig.autoShareOnSleep)
+        return;
+    // Both skip counters are surfaced so the secret veto and the rejection tombstone are observable, not silent.
+    const autoShareStats = { secretSkipped: 0, rejectedSkipped: 0 };
+    const shared = phases.autoShare(ctx.hippoRoot, { minScore: 0.6, stats: autoShareStats });
+    if (shared.length > 0) {
+        result.shared = shared.length;
+    }
+    if (autoShareStats.secretSkipped > 0) {
+        result.secretSkipped = autoShareStats.secretSkipped;
+    }
+    if (autoShareStats.rejectedSkipped > 0) {
+        result.rejectedSkipped = autoShareStats.rejectedSkipped;
+    }
+}
+/** Returns the ambient total the audit row reports: 0 when ambient is off or no current row is left. */
+function summarizeAmbient(ctx, phases, result) {
+    const postSleepConfig = phases.loadConfig(ctx.hippoRoot);
+    if (!postSleepConfig.ambient.enabled)
+        return 0;
+    const postSleepEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !e.superseded_by);
+    if (postSleepEntries.length === 0)
+        return 0;
+    result.ambient = phases.computeAmbientState(postSleepEntries);
+    return result.ambient.totalMemories;
+}
+// Phase 6: rebuild the graph of every tenant marked dirty since the last sleep, so graph recall runs on fresh data.
+// Fault-isolated: consolidation has already committed, so no failure here aborts sleep; a failed tenant stays pending.
+function drainGraphQueue(ctx, phases, snapshot, result) {
+    try {
+        if (snapshot.error) {
+            // Core sleep already succeeded; surface the skipped graph refresh as a detail.
+            result.details = [
+                ...(result.details ?? []),
+                `graph: dirty-tenant snapshot failed (skipped graph refresh): ${snapshot.error}`,
+            ];
+        }
+        let gTenants = 0;
+        let gEntities = 0;
+        let gRelations = 0;
+        // dirtyTenants was snapshotted before the memory-deleting phases above.
+        for (const { tenantId, maxPendingId } of snapshot.dirtyTenants) {
             try {
-                const sleepAuditMetadata = {
-                    consolidationCount,
-                    dedupCount,
-                    auditDeletedCount,
-                    ambientTotal,
-                    dryRun,
-                    noShare: opts.noShare ?? false,
-                    partial: phaseError !== null,
-                    triggeredByTenant: ctx.tenantId, // preserve for audit forensics
-                };
-                if (phaseError)
-                    sleepAuditMetadata.errorMessage = phaseError.message;
-                appendAuditEvent(db, {
-                    tenantId: '__host__',
-                    actor: ctx.actor.subject,
-                    op: 'consolidate',
-                    metadata: { ...sleepAuditMetadata },
-                });
+                const ext = phases.extractGraph(ctx.hippoRoot, tenantId);
+                // Count the rebuild as soon as it succeeds — it happened regardless of
+                // the drain-mark below.
+                gTenants += 1;
+                gEntities += ext.entities;
+                gRelations += ext.relations;
+                // Watermark drain: only items enqueued before this rebuild started are marked; later arrivals stay pending.
+                markPendingProcessedUpTo(ctx.hippoRoot, tenantId, maxPendingId);
             }
-            finally {
-                closeHippoDb(db);
+            catch (tenantErr) {
+                // SAFETY: this is a best-effort log message only; property access
+                // on any JS value is safe (undefined if absent), preserving the
+                // existing lenient formatting even when something non-Error was thrown.
+                result.details = [
+                    ...(result.details ?? []),
+                    `graph: extract failed for a dirty tenant (left pending): ${tenantErr.message}`,
+                ];
             }
         }
-        catch (auditErr) {
-            // Logged, never thrown: a second failure must not mask the original phaseError.
-            reportAuditWriteFailure('consolidate', String(auditErr));
+        if (gTenants > 0) {
+            result.graph = { tenants: gTenants, entities: gEntities, relations: gRelations };
         }
     }
+    catch (graphErr) {
+        // SAFETY: this is a best-effort log message only; property access on
+        // any JS value is safe (undefined if absent), preserving the existing
+        // lenient formatting even when something non-Error was thrown.
+        result.details = [
+            ...(result.details ?? []),
+            `graph: drain phase failed (skipped): ${graphErr.message}`,
+        ];
+    }
+}
+// One 'consolidate' row per sleep, emitted from finally so a partial failure still reports what got done.
+// Its own handle; an audit failure is logged and never replaces the original phase error.
+function emitSleepAudit(ctx, opts, dryRun, counts, phaseError) {
+    try {
+        const db = openHippoDb(ctx.hippoRoot);
+        try {
+            const sleepAuditMetadata = {
+                consolidationCount: counts.consolidation,
+                dedupCount: counts.dedup,
+                auditDeletedCount: counts.auditDeleted,
+                ambientTotal: counts.ambient,
+                dryRun,
+                noShare: opts.noShare ?? false,
+                partial: phaseError !== null,
+                triggeredByTenant: ctx.tenantId, // preserve for audit forensics
+            };
+            if (phaseError)
+                sleepAuditMetadata.errorMessage = phaseError.message;
+            appendAuditEvent(db, {
+                tenantId: '__host__',
+                actor: ctx.actor.subject,
+                op: 'consolidate',
+                metadata: { ...sleepAuditMetadata },
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+    }
+    catch (auditErr) {
+        // Logged, never thrown: a second failure must not mask the original phaseError.
+        reportAuditWriteFailure('consolidate', String(auditErr));
+    }
 }
 //# sourceMappingURL=sleep.js.map

package/dist/api/tokens.d.ts

@@ -2,7 +2,7 @@ import { type TokenSummary, type TokenSurface } from '../token-ledger.js';
 import { type FailureSummary } from '../failure-log.js';
 import type { Context } from './types.js';
 /**
- * Record memory text handed to an agent in the token ledger (ROADMAP TE0).
+ * Record memory text handed to an agent in the token ledger.
  * Best-effort: never throws, because a ledger failure must not fail the
  * recall or context call that produced the text.
  */
@@ -19,7 +19,7 @@ export declare function recordTokens(ctx: Context, surface: TokenSurface, use: {
 export declare function tokenSummary(ctx: Context, opts?: {
     days?: number;
 }): TokenSummary;
-/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30); ROADMAP CD13. */
+/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30). */
 export declare function failureSummary(ctx: Context, opts?: {
     days?: number;
 }): FailureSummary;

package/dist/api/tokens.js

@@ -4,7 +4,7 @@ import { recordTokenUse, summarizeTokenUse } from '../token-ledger.js';
 import { summarizeFailures } from '../failure-log.js';
 import { log } from '../log.js';
 /**
- * Record memory text handed to an agent in the token ledger (ROADMAP TE0).
+ * Record memory text handed to an agent in the token ledger.
  * Best-effort: never throws, because a ledger failure must not fail the
  * recall or context call that produced the text.
  */
@@ -43,7 +43,7 @@ export function tokenSummary(ctx, opts = {}) {
         closeHippoDb(db);
     }
 }
-/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30); ROADMAP CD13. */
+/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30). */
 export function failureSummary(ctx, opts = {}) {
     const db = openHippoDb(ctx.hippoRoot);
     try {

package/dist/api/types.d.ts

@@ -1,18 +1,16 @@
 import { BadRequestError } from '../api-errors.js';
 /**
- * Actor identity + authorization role for a Context. v1.12.0 A5 v2 sub-1.
+ * Actor identity + authorization role for a Context.
  *
- * Before v1.12.0, Context.actor was a bare string. v1.12.0 promotes it to an
- * object carrying both the audit-log subject (formerly the string itself) and
- * a role for /v1/sleep admin gating. Audit helpers continue accepting `string`
- * — callers pass `ctx.actor.subject`. Role checks happen at the request
+ * Carries the audit-log subject plus a role for /v1/sleep admin gating. Audit
+ * helpers take the bare `string`, so callers pass `ctx.actor.subject`. Role checks happen at the request
  * boundary (e.g. /v1/sleep), except in authCreate and authRevoke (ForbiddenError).
  */
 export interface Actor {
     /** 'cli' | 'localhost:cli' | 'api_key:<key_id>' | 'mcp' | 'connector:slack' | 'connector:github' */
     subject: string;
     role: 'admin' | 'member';
-    /** EI2: restricted scopes a member key may read (auth.ts grantScope). Unused for admin actors. */
+    /** Restricted scopes a member key may read (auth.ts grantScope). Unused for admin actors. */
     scopes?: readonly string[];
     /** An auth resolver vouched for this caller, so its admin role stops at its own tenant. */
     viaAuthResolver?: true;
@@ -44,10 +42,8 @@ export declare function adminActor(subject: string): Actor;
  *     is opt-in so multi-session tenants can fail loud instead of silently
  *     surfacing cross-session rows tagged `isFreshTail=true`.
  *   - 'invalid_scorer_window' — `opts.scorerWindow` is set to a non-positive,
- *     non-integer, or non-finite value. Pre-v1.7.0 the value 0 routed
- *     through FTS/LIKE `LIMIT 0` and then fell through to an uncapped
- *     full-store fallback (codex v1.7.0 diff-pass P1). Validated upfront
- *     so the contract holds.
+ *     non-integer, or non-finite value. 0 would route through FTS/LIKE
+ *     `LIMIT 0` and then an uncapped full-store fallback, so it is validated upfront.
  */
 export declare class RecallContractError extends BadRequestError {
     readonly code: 'fresh_tail_requires_session_id' | 'invalid_scorer_window';

package/dist/api/types.js

@@ -22,10 +22,8 @@ export function adminActor(subject) {
  *     is opt-in so multi-session tenants can fail loud instead of silently
  *     surfacing cross-session rows tagged `isFreshTail=true`.
  *   - 'invalid_scorer_window' — `opts.scorerWindow` is set to a non-positive,
- *     non-integer, or non-finite value. Pre-v1.7.0 the value 0 routed
- *     through FTS/LIKE `LIMIT 0` and then fell through to an uncapped
- *     full-store fallback (codex v1.7.0 diff-pass P1). Validated upfront
- *     so the contract holds.
+ *     non-integer, or non-finite value. 0 would route through FTS/LIKE
+ *     `LIMIT 0` and then an uncapped full-store fallback, so it is validated upfront.
  */
 export class RecallContractError extends BadRequestError {
     code;