hippo-memory 1.62.0 → 1.63.0

package/dist/shared.js

@@ -19,8 +19,9 @@ import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from './recall
 import { search } from './search/bm25-search.js';
 import { hybridSearch } from './search/hybrid.js';
 import { fitBudget } from './search/finalize.js';
+import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from './search/types.js';
 import { evalNow } from './ablation.js';
-import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir } from './project-identity.js';
+import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir, resolveProjectIdentity } from './project-identity.js';
 import { detectSecret } from './secret-detect.js';
 import { isQuarantineScope } from './quarantine.js';
 import { RejectedValueError } from './rejection.js';
@@ -62,12 +63,12 @@ export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
     if (!entry)
         throw new NotFoundError(`Memory not found: ${id}`);
-    // CD5: same veto as shareMemory; a promoted copy would have no quarantine record to review.
+    // Same quarantine veto as shareMemory; a promoted copy would have no quarantine record to review.
     if (isQuarantineScope(entry.scope)) {
         throw new BadRequestError(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
     }
-    // v39 S4 producer veto: promote is a producer path to the global store
-    // exactly like shareMemory - same hard rule (codex gating review P2).
+    // Secret producer veto: promote is a producer path to the global store
+    // exactly like shareMemory - same hard rule.
     const promoteSecret = detectSecret(entry);
     if (promoteSecret.flagged) {
         throw new BadRequestError(`Refusing to promote ${id} to the global store: content matches secret material (${promoteSecret.reason}). ` +
@@ -95,7 +96,7 @@ export function promoteToGlobal(localRoot, id, opts) {
  * Returns results sorted by adjusted score, within combined token budget.
  */
 export function searchBoth(query, localRoot, globalRoot, options = {}) {
-    const { budget = 4000, now = evalNow(), minResults, tenantId } = options;
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), minResults, tenantId } = options;
     const effectiveMin = minResults ?? 1;
     const localEntries = fs.existsSync(localRoot) ? loadSearchEntries(localRoot, query, undefined, tenantId) : [];
     const globalEntries = fs.existsSync(globalRoot) ? loadSearchEntries(globalRoot, query, undefined, tenantId) : [];
@@ -105,14 +106,13 @@ export function searchBoth(query, localRoot, globalRoot, options = {}) {
     const localResults = search(query, localEntries, { budget, now, minResults });
     const globalResults = search(query, globalEntries, { budget, now, minResults });
     // Tag global results. Local memories get a configurable priority bump.
-    const syncLocalBump = 1.2;
     const tagged = [
         ...localResults.map((r) => ({
             ...r,
             isGlobal: false,
-            score: r.score * syncLocalBump,
+            score: r.score * DEFAULT_LOCAL_BUMP,
             breakdown: r.breakdown
-                ? { ...r.breakdown, sourceBump: syncLocalBump, final: r.breakdown.final * syncLocalBump }
+                ? { ...r.breakdown, sourceBump: DEFAULT_LOCAL_BUMP, final: r.breakdown.final * DEFAULT_LOCAL_BUMP }
                 : undefined,
         })),
         ...globalResults.map((r) => ({ ...r, isGlobal: true })),
@@ -126,11 +126,8 @@ export function searchBoth(query, localRoot, globalRoot, options = {}) {
         seen.add(key);
         return true;
     });
-    // T2 note: PLAIN stable score sort on purpose -- local/global inputs are
-    // each deterministically ordered (content tail applied in the underlying
-    // search), stability inherits that, and an exact post-bump tie keeps the
-    // LOCAL result ahead of the global one (the concat order), preserving the
-    // pre-T2 semantics.
+    // PLAIN stable score sort on purpose: both inputs are deterministically ordered,
+    // and an exact tie keeps the LOCAL result ahead of the global one (concat order).
     deduped.sort((a, b) => b.score - a.score);
     // Apply combined token budget (guarantee at least minResults items)
     const results = [];
@@ -151,13 +148,10 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
     const { includeSuperseded, asOf, tenantId, entryFilter, recallScope } = options;
     // When an admission filter is active, lift the per-store candidate cap
     // (default 200): excluded rows matching the query could otherwise fill the
-    // window before any admitted row is even loaded (codex gating round 6).
-    // 5000 = 25x the default 200-row window: large enough that exclusion
-    // crowding is a non-issue on real stores, bounded so a common query term
-    // on a 100k-row store cannot stall an interactive call by ranking every
-    // match (post-merge adversarial review, 2026-07-02).
+    // window before any admitted row is even loaded. 5000 is bounded so a common
+    // term on a large store cannot stall an interactive call by ranking every match.
     const searchWindow = entryFilter ? 5000 : undefined;
-    // v1.25.0 recall mode: push the scope predicate into SQL exactly like
+    // Recall mode: push the scope predicate into SQL exactly like
     // api.recall (loadRecallSearchEntries), so quarantine/private rows never
     // enter the candidate set, never shadow admitted duplicates in the dedupe
     // pass, and never consume budget. The JS post-filter below is the
@@ -187,7 +181,7 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
 }
 /** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
 export async function rankBothStores(query, roots, entries, vectorCandidates, options = {}) {
-    const { budget = 4000, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = 1.2, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness } = options;
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = DEFAULT_LOCAL_BUMP, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness } = options;
     if (entries.local.length === 0 && entries.global.length === 0)
         return [];
     const shared = { budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness, vectorCandidates };
@@ -214,7 +208,7 @@ export async function rankBothStores(query, roots, entries, vectorCandidates, op
         seen.add(key);
         return true;
     });
-    // T2 note: PLAIN stable score sort on purpose -- see searchBoth above;
+    // PLAIN stable score sort on purpose -- see searchBoth above;
     // same rationale (deterministic inputs + stability; local-first on ties).
     deduped.sort((a, b) => b.score - a.score);
     return fitBudget(deduped, budget, minResults ?? 1, cost);
@@ -286,7 +280,7 @@ export function shareMemory(localRoot, id, options = {}) {
     const entry = readEntry(localRoot, id, options.tenantId);
     if (!entry)
         throw new NotFoundError(`Memory not found: ${id}`);
-    // v39 S4 producer veto: secrets never go to the global store, not even
+    // Secret producer veto: secrets never go to the global store, not even
     // with --force. Explicit and loud - a silent null would read as "low
     // transfer score" and invite retries.
     const secret = detectSecret(entry);
@@ -294,7 +288,7 @@ export function shareMemory(localRoot, id, options = {}) {
         throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
             `Secrets stay in their owning project's store.`);
     }
-    // CD5: a quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    // A quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
     if (isQuarantineScope(entry.scope)) {
         throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
     }
@@ -328,7 +322,7 @@ export function shareMemory(localRoot, id, options = {}) {
  * List all projects that have contributed memories to the global store.
  * Parses the source field for 'shared:<project>:' or 'promoted:<path>' patterns.
  *
- * D4 v1.12.10: `tenantId` is now optional. When provided, the global entries
+ * `tenantId` is optional. When provided, the global entries
  * are filtered to that tenant before aggregation — matches every other
  * read path's default-safe behaviour. When undefined, host-wide (back-compat
  * for legacy callers like CLI standalone + dashboard internal use). Operators
@@ -339,7 +333,7 @@ export function listPeers(globalRoot, tenantId) {
     const root = globalRoot ?? getGlobalRoot();
     if (!fs.existsSync(root))
         return [];
-    // D4: tenant-scoped by default when tenantId provided. Host-wide when
+    // Tenant-scoped by default when tenantId provided. Host-wide when
     // undefined (preserves back-compat).
     const tallies = tallySources(root, tenantId).sort((a, b) => (a.first < b.first ? -1 : a.first > b.first ? 1 : 0));
     const peerMap = new Map();
@@ -370,25 +364,85 @@ export function listPeers(globalRoot, tenantId) {
         .map(([project, data]) => ({ project, ...data }))
         .sort((a, b) => b.count - a.count);
 }
+function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
+    // shareMemory refuses quarantined rows; filtering here keeps sleep from aborting on one.
+    if (isQuarantineScope(entry.scope ?? null))
+        return false;
+    // Before the score: these rows describe one project only, and a git seed's 'error' tag clears the bar.
+    if (entry.tags.some((t) => NEVER_AUTO_SHARE_TAGS.has(t)) || entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX)) {
+        if (stats)
+            stats.neverAutoShareSkipped = (stats.neverAutoShareSkipped ?? 0) + 1;
+        return false;
+    }
+    const score = transferScore(entry);
+    if (score < minScore)
+        return false;
+    // Skip if already shared (same text apart from spacing)
+    if (globalContentSet.has(duplicateKey(entry.content)))
+        return false;
+    // Secret producer veto: secret rows never auto-share, regardless of
+    // transfer score. (shareMemory would throw; filtering here keeps the
+    // sleep pipeline fail-safe.) Checked LAST so the stats counter
+    // only counts rows the veto actually withheld — a row failing the score
+    // or dedupe gates was never going to share, secret or not.
+    if (detectSecret(entry).flagged) {
+        if (stats)
+            stats.secretSkipped++;
+        return false;
+    }
+    return true;
+}
+// Rejection containment (sync/promote/share copy paths must not let ONE rejected
+// candidate kill the batch): shareMemory -> writeEntry hits the LIVE guard
+// against the GLOBAL store's tombstones. A matching candidate throws
+// RejectedValueError, which (uncaught) would abort this whole loop and,
+// via api.ts's sleep pipeline, the entire autoShare sleep phase. Mirrors
+// syncGlobalToLocal's per-item catch just above in this file. writeEntry's
+// own catch already writes the reject_refusal audit before rethrowing,
+// so do not double-audit here, just count and continue.
+function shareCandidates(localRoot, candidates, stats) {
+    const shared = [];
+    let rejectedSkipped = 0;
+    for (const entry of candidates) {
+        try {
+            // skipEmbed: batching invariant, this is a batch producer, so it embeds
+            // once via embedAll() below rather than once per row inside shareMemory.
+            const result = shareMemory(localRoot, entry.id, { force: true, skipEmbed: true });
+            if (result)
+                shared.push(result);
+        }
+        catch (err) {
+            if (err instanceof RejectedValueError) {
+                rejectedSkipped++;
+                if (stats)
+                    stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
+                continue;
+            }
+            throw err;
+        }
+    }
+    if (rejectedSkipped > 0) {
+        log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
+    }
+    return shared;
+}
 /**
  * Auto-share: local memories with high transfer scores, not already global, no NEVER_AUTO_SHARE_TAGS tag.
  * Returns the list of shared entries.
  *
- * L9: `options.tenantId` is opt-in. When provided, the LOCAL-entries read is
+ * `options.tenantId` is opt-in. When provided, the LOCAL-entries read is
  * scoped to that tenant. When undefined, the local read is host-wide (current
  * behaviour). The GLOBAL-entries read is always unioned — the global root IS
- * the cross-tenant aggregate by design. The only intentional unscoped
- * internal caller as of v1.12.1 is `api.sleep` (`src/api.ts:2041`), which
- * passes options without tenantId because `sleep` is host-wide by intent;
- * see `src/api.ts:2073-2077` for the cross-tenant dedup rationale.
+ * the cross-tenant aggregate by design. `api.sleep` passes no tenantId
+ * because `sleep` is host-wide by intent.
  *
- * v1.25.0: `options.stats` is an opt-in out-param. When provided,
+ * `options.stats` is an opt-in out-param. When provided,
  * `stats.secretSkipped` is incremented once per row that passed every OTHER
  * admission gate (transfer score, not-already-global) and was withheld SOLELY
  * by the secret veto — i.e. it counts shares actually prevented, not secret
  * rows merely present. Filled identically under `dryRun`.
  *
- * AT1: `stats.rejectedSkipped` (optional) is incremented once per candidate
+ * `stats.rejectedSkipped` (optional) is incremented once per candidate
  * refused by the GLOBAL store's rejection tombstone (RejectedValueError from
  * shareMemory -> writeEntry). Unlike secretSkipped, this can only be
  * detected by attempting the write — `dryRun` returns candidates before the
@@ -401,73 +455,15 @@ export function autoShare(localRoot, options = {}) {
     const localEntries = loadAllEntries(localRoot, options.tenantId);
     initGlobal();
     const globalRoot = getGlobalRoot();
-    // L9: host-wide read. The global store IS the union across all tenants;
+    // Host-wide read. The global store IS the union across all tenants;
     // per-tenant filtering on the global root would defeat the purpose.
     const globalEntries = loadAllEntries(globalRoot);
     // Build set of global content hashes to avoid duplicates
     const globalContentSet = storedTextKeys(globalEntries);
-    const candidates = localEntries.filter((entry) => {
-        // CD5: shareMemory refuses quarantined rows; filtering here keeps sleep from aborting on one.
-        if (isQuarantineScope(entry.scope ?? null))
-            return false;
-        // Before the score: these rows describe one project only, and a git seed's 'error' tag clears the bar.
-        if (entry.tags.some((t) => NEVER_AUTO_SHARE_TAGS.has(t)) || entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX)) {
-            if (options.stats)
-                options.stats.neverAutoShareSkipped = (options.stats.neverAutoShareSkipped ?? 0) + 1;
-            return false;
-        }
-        const score = transferScore(entry);
-        if (score < minScore)
-            return false;
-        // Skip if already shared (same text apart from spacing)
-        if (globalContentSet.has(duplicateKey(entry.content)))
-            return false;
-        // v39 S4 producer veto: secret rows never auto-share, regardless of
-        // transfer score. (shareMemory would throw; filtering here keeps the
-        // sleep pipeline fail-safe.) Checked LAST (v1.25.0) so the stats counter
-        // only counts rows the veto actually withheld — a row failing the score
-        // or dedupe gates was never going to share, secret or not.
-        if (detectSecret(entry).flagged) {
-            if (options.stats)
-                options.stats.secretSkipped++;
-            return false;
-        }
-        return true;
-    });
+    const candidates = localEntries.filter((entry) => isAutoShareCandidate(entry, globalContentSet, minScore, options.stats));
     if (dryRun)
         return candidates;
-    const shared = [];
-    // AT1 containment (docs/plans/2026-08-15-at1-rejected-value-tombstone.md
-    // plan §3 — sync/promote/share copy paths must not let ONE rejected
-    // candidate kill the batch): shareMemory -> writeEntry hits the LIVE guard
-    // against the GLOBAL store's tombstones. A matching candidate throws
-    // RejectedValueError, which (uncaught) would abort this whole loop and,
-    // via api.ts's sleep pipeline, the entire autoShare sleep phase. Mirrors
-    // syncGlobalToLocal's per-item catch just above in this file. writeEntry's
-    // own catch already writes the reject_refusal audit before rethrowing
-    // (plan §3) — do not double-audit here, just count and continue.
-    let rejectedSkipped = 0;
-    for (const entry of candidates) {
-        try {
-            // skipEmbed: batching invariant, this is a batch producer, so it embeds
-            // once via embedAll() below rather than once per row inside shareMemory.
-            const result = shareMemory(localRoot, entry.id, { force: true, skipEmbed: true });
-            if (result)
-                shared.push(result);
-        }
-        catch (err) {
-            if (err instanceof RejectedValueError) {
-                rejectedSkipped++;
-                if (options.stats)
-                    options.stats.rejectedSkipped = (options.stats.rejectedSkipped ?? 0) + 1;
-                continue;
-            }
-            throw err;
-        }
-    }
-    if (rejectedSkipped > 0) {
-        log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
-    }
+    const shared = shareCandidates(localRoot, candidates, options.stats);
     if (shared.length > 0) {
         void embedAll(globalRoot).catch((err) => logEmbedAllFailure('autoShare', err));
     }
@@ -481,18 +477,18 @@ export function autoShare(localRoot, options = {}) {
 export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
     if (!fs.existsSync(globalRoot))
         return 0;
-    // L9: host-wide read. syncGlobalToLocal copies the global union into a
+    // Host-wide read. syncGlobalToLocal copies the global union into a
     // tenant-scoped local store; writeEntry on each row carries the tenant if
     // the local-root context provides one.
     const globalEntries = loadAllEntries(globalRoot);
     const localIndex = loadIndex(localRoot);
     const textKey = (e) => `${e.tenantId}\n${e.content}`;
     const localText = new Set(loadAllEntries(localRoot).map(textKey));
-    // v39 (codex P1-4): syncing down must not re-import what ambient context
+    // Syncing down must not re-import what ambient context
     // excludes - other-project rows are skipped by default and secret rows
     // are never copied. origin_project is preserved on the copy (writeEntry
     // only stamps when the field is missing).
-    const currentName = deriveOriginProject(path.dirname(path.resolve(localRoot)));
+    const currentProject = resolveProjectIdentity(path.dirname(path.resolve(localRoot)));
     let count = 0;
     // A locally rejected value must not come back through sync down: caught per item, printed as one line.
     let rejected = 0;
@@ -508,7 +504,7 @@ export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
         if (detectSecret(entry).flagged)
             continue;
         if (!opts.includeCrossProject &&
-            classifyOriginProject(entry.origin_project, currentName) === 'cross-project')
+            classifyOriginProject(entry.origin_project, currentProject) === 'cross-project')
             continue;
         try {
             writeEntry(localRoot, entry);

package/dist/skills.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 skill first-class object (docs/plans/2026-05-30-e2-skill-object.md).
+ * Skills as a first-class, versioned object.
  *
  * A `skill` is a reusable, agent-followable capability: an `instructions` body
  * plus an optional `trigger` ("when to apply"), evolving via the supersede delta
@@ -29,8 +29,8 @@ export declare const VALID_SKILL_STATES: ReadonlySet<SkillStatus>;
 export declare const MAX_SKILL_NAME_LEN = 256;
 export declare const MAX_SKILL_INSTRUCTIONS_LEN = 8192;
 export declare const MAX_SKILL_TRIGGER_LEN = 1024;
-/** Aggregate bound on a single export render (plan-eng-critic: cap the unbounded
- *  export body). Realistic active-skill counts are tens; 1000 is a generous bound. */
+/** Aggregate bound on a single export render so the export body is never unbounded.
+ *  Realistic active-skill counts are tens; 1000 is a generous bound. */
 export declare const MAX_EXPORT_SKILLS = 1000;
 export interface Skill {
     id: number;

package/dist/skills.js

@@ -1,5 +1,5 @@
 /**
- * E2 skill first-class object (docs/plans/2026-05-30-e2-skill-object.md).
+ * Skills as a first-class, versioned object.
  *
  * A `skill` is a reusable, agent-followable capability: an `instructions` body
  * plus an optional `trigger` ("when to apply"), evolving via the supersede delta
@@ -39,13 +39,13 @@ export const VALID_SKILL_STATES = new Set([
 export const MAX_SKILL_NAME_LEN = 256;
 export const MAX_SKILL_INSTRUCTIONS_LEN = 8192;
 export const MAX_SKILL_TRIGGER_LEN = 1024;
-/** Aggregate bound on a single export render (plan-eng-critic: cap the unbounded
- *  export body). Realistic active-skill counts are tens; 1000 is a generous bound. */
+/** Aggregate bound on a single export render so the export body is never unbounded.
+ *  Realistic active-skill counts are tens; 1000 is a generous bound. */
 export const MAX_EXPORT_SKILLS = 1000;
 /**
  * Validate + normalise skill fields. skill_name is trimmed and MUST be a single
- * line (no newlines) so it cannot break the H2 header in the export render
- * (plan-eng-critic). instructions are kept verbatim (operator content) but capped.
+ * line (no newlines) so it cannot break the H2 header in the export render.
+ * instructions are kept verbatim (operator content) but capped.
  * Returns the normalised name + trigger (null when absent/empty).
  */
 function validateSkillFields(skillName, instructions, trigger) {
@@ -69,8 +69,8 @@ function validateSkillFields(skillName, instructions, trigger) {
             throw new BadRequestError(`saveSkill: trigger exceeds the ${MAX_SKILL_TRIGGER_LEN}-char cap`);
         }
         // Single-line, like skill_name: a trigger is a short "when to apply" phrase,
-        // and a newline would let it forge a heading inside the export **When:** line
-        // (independent-review 2026-05-30). Reject rather than emit a multi-line trigger.
+        // and a newline would let it forge a heading inside the export **When:** line.
+        // Reject rather than emit a multi-line trigger.
         if (/[\r\n]/.test(trigger)) {
             throw new BadRequestError('saveSkill: trigger must be a single line (no newlines)');
         }
@@ -114,7 +114,7 @@ function buildSkillContent(skillName, instructions, trigger) {
 // Preflight the supersede target BEFORE inserting the new row (so the new
 // autoincrement id can never be its own supersede target); read the
 // predecessor version in the same SELECT for server-derived versioning.
-// Mirrors saveProcess / savePolicy (codex P1 2026-05-28).
+// Mirrors saveProcess / savePolicy.
 function preflightSkillSupersede(db, tenantId, supersedesId) {
     // SAFETY: row shape matches the `status, version` columns named in the SELECT below.
     const pred = db.prepare(`SELECT status, version FROM skills WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);

package/dist/store/audit-event.d.ts

@@ -1,7 +1,7 @@
 import { openHippoDb } from '../db.js';
 import { type AuditOp } from '../audit.js';
 import { RejectedValueError } from '../rejection.js';
-import type { JsonValue } from './rows.js';
+import type { JsonValue } from '../json.js';
 /**
  * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
  * log can never crash the surrounding mutation — the SQLite store is still the
@@ -9,7 +9,7 @@ import type { JsonValue } from './rows.js';
  */
 export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, targetId?: string, metadata?: Record<string, JsonValue>, actor?: string, tenantId?: string): void;
 /**
- * Refusal audit for the AT1 rejection guard (plan §3). Written by the
+ * Refusal audit for the rejected-value guard. Written by the
  * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
  * there, so this lands in a fresh implicit transaction) and api.supersede's
  * catch (after its own ROLLBACK) — never inside a scope the caller's own

package/dist/store/audit-event.js

@@ -21,7 +21,7 @@ export function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
     }
 }
 /**
- * Refusal audit for the AT1 rejection guard (plan §3). Written by the
+ * Refusal audit for the rejected-value guard. Written by the
  * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
  * there, so this lands in a fresh implicit transaction) and api.supersede's
  * catch (after its own ROLLBACK) — never inside a scope the caller's own

package/dist/store/candidates.d.ts

@@ -16,8 +16,8 @@ export declare function loadAmbientCandidates(hippoRoot: string, tenantId: strin
 export interface ContextCandidateFilter {
     /** Envelope scope asked for by name; absent applies recall's default deny. */
     exactScope?: string;
-    /** Rows of this project and user-global rows pass; absent admits every origin. */
-    project?: string;
+    /** Rows carrying one of these project names, and user-global rows, pass; absent admits every origin. */
+    project?: readonly string[];
     /** Most rows returned; past it, the rows decay has worn least win. */
     cap: number;
     now: Date;

package/dist/store/candidates.js

@@ -2,6 +2,7 @@ import { closeHippoDb } from '../db.js';
 import { RECALL_DEFAULT_DENY_SCOPES } from '../recall-scope.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { openStore } from './open.js';
+import { originInSql } from '../project-identity.js';
 import { pickRarestFtsQuery, loadRecallSearchEntriesFromDb } from './search-rows.js';
 const AMBIENT_SCOPED = 'superseded_by IS NULL AND tenant_id = ?';
 /** Exported so the plan test runs the exact SQL; idx_memories_pinned (db.ts v51) serves it. */
@@ -9,7 +10,7 @@ export const AMBIENT_PINNED_WHERE = `pinned = 1 AND ${AMBIENT_SCOPED} ORDER BY c
 /** Exported so the plan test runs the exact SQL; idx_memories_created_drift (db.ts v51) serves it. */
 export const AMBIENT_DRIFT_SQL = `SELECT 1 FROM memories WHERE ${AMBIENT_SCOPED} AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1`;
 // The pins plus the `recentNeeded` newest rows that pass `admit`, for ambient
-// injection. One connection; `recall` piggybacks the Z1 FTS query on it too.
+// injection. One connection; `recall` piggybacks the prompt-recall FTS query on it too.
 export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit, recall) {
     // A SQL LIMIT takes an integer; the Array.slice this replaced truncated one,
     // and include_recent is any non-negative finite number at the HTTP edge.
@@ -78,8 +79,8 @@ export function loadContextCandidates(hippoRoot, tenantId, filter) {
         params.push(...RECALL_DEFAULT_DENY_SCOPES);
     }
     if (filter.project !== undefined) {
-        where.push(`(origin_project = '' OR origin_project = ?)`);
-        params.push(filter.project);
+        where.push(`(origin_project = '' OR ${originInSql(filter.project)})`);
+        params.push(...filter.project);
     }
     const db = openStore(hippoRoot);
     try {

package/dist/store/conflicts.js

@@ -3,7 +3,8 @@ import { rejectionDigest, insertRejectedValue, normalizeValueForRejection } from
 import { archiveRawMemory } from '../raw-archive.js';
 import { rowToMemoryConflict } from './rows.js';
 import { audit } from './audit-event.js';
-import { syncMirrorFiles, purgeMirrorBestEffort } from './mirrors.js';
+import { syncChangedMirrors, purgeMirrorBestEffort } from './mirrors.js';
+import { selectEntriesByIds } from './entry-reads.js';
 import { openStore } from './open.js';
 import { deleteEntryCore } from './delete-and-batch.js';
 function canonicalConflictPair(aId, bId) {
@@ -81,9 +82,9 @@ export function replaceDetectedConflicts(hippoRoot, detected, detectedAt = new D
         }));
         resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt);
         upsertDetectedConflicts(db, canonicalDetected, sameTenant, detectedAt);
-        rebuildConflictsWithJson(db, sameTenant);
+        const changedIds = rebuildConflictsWithJson(db, sameTenant);
         db.exec('COMMIT');
-        syncMirrorFiles(hippoRoot, db);
+        syncChangedMirrors(hippoRoot, db, [...selectEntriesByIds(db, changedIds).values()]);
     }
     catch (error) {
         try {
@@ -123,36 +124,38 @@ function resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt
     FROM memory_conflicts
     WHERE status = 'open'
   `).all();
+    const resolve = db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = ? WHERE id = ?`);
     for (const row of openRows) {
         const key = `${row.memory_a_id}::${row.memory_b_id}`;
         const stale = !detectedKeys.has(key);
         // v1.11.0 residue: auto-resolve any open cross-tenant row. The insert
-        // loop below (line 2089) and the refMap rebuild (line 2117) skip
+        // loop in upsertDetectedConflicts and the refMap rebuild skip
         // cross-tenant pairs, but the resolve-stale loop previously left
         // re-detected cross-tenant rows lingering status='open'. The
         // sameTenant() helper is already built one block up; no extra query.
         const crossTenant = !sameTenant(row.memory_a_id, row.memory_b_id);
-        if (stale || crossTenant) {
-            db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = ? WHERE id = ?`).run(detectedAt, row.id);
-        }
+        if (stale || crossTenant)
+            resolve.run(detectedAt, row.id);
     }
 }
 function upsertDetectedConflicts(db, canonicalDetected, sameTenant, detectedAt) {
+    const upsert = db.prepare(`
+    INSERT INTO memory_conflicts(memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at)
+    VALUES (?, ?, ?, ?, 'open', ?, ?)
+    ON CONFLICT(memory_a_id, memory_b_id) DO UPDATE SET
+      reason = excluded.reason,
+      score = excluded.score,
+      status = 'open',
+      updated_at = excluded.updated_at
+  `);
     for (const conflict of canonicalDetected) {
         // Skip cross-tenant pairs — never persist a conflict spanning tenants.
         if (!sameTenant(conflict.memory_a_id, conflict.memory_b_id))
             continue;
-        db.prepare(`
-      INSERT INTO memory_conflicts(memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at)
-      VALUES (?, ?, ?, ?, 'open', ?, ?)
-      ON CONFLICT(memory_a_id, memory_b_id) DO UPDATE SET
-        reason = excluded.reason,
-        score = excluded.score,
-        status = 'open',
-        updated_at = excluded.updated_at
-    `).run(conflict.memory_a_id, conflict.memory_b_id, conflict.reason, conflict.score, detectedAt, detectedAt);
+        upsert.run(conflict.memory_a_id, conflict.memory_b_id, conflict.reason, conflict.score, detectedAt, detectedAt);
     }
 }
+/** Rewrites only the rows whose conflicts_with_json changes, and returns their ids. */
 function rebuildConflictsWithJson(db, sameTenant) {
     // SAFETY: openConflicts' shape matches the two columns named above.
     const openConflicts = db.prepare(`
@@ -173,13 +176,18 @@ function rebuildConflictsWithJson(db, sameTenant) {
         refMap.get(row.memory_a_id).add(row.memory_b_id);
         refMap.get(row.memory_b_id).add(row.memory_a_id);
     }
-    // SAFETY: memoryRows' shape matches the single `id` column selected
-    // above.
-    const memoryRows = db.prepare(`SELECT id FROM memories`).all();
+    // SAFETY: memoryRows' shape matches the two columns selected below.
+    const memoryRows = db.prepare(`SELECT id, conflicts_with_json FROM memories`).all();
+    const update = db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?`);
+    const changedIds = [];
     for (const memory of memoryRows) {
-        const refs = Array.from(refMap.get(memory.id) ?? []).sort();
-        db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?`).run(JSON.stringify(refs), memory.id);
+        const refsJson = JSON.stringify(Array.from(refMap.get(memory.id) ?? []).sort());
+        if (memory.conflicts_with_json === refsJson)
+            continue;
+        update.run(refsJson, memory.id);
+        changedIds.push(memory.id);
     }
+    return changedIds;
 }
 /**
  * Resolve a conflict by keeping one memory and weakening the other.
@@ -230,7 +238,7 @@ export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = fal
         stripConflictRefs(db, target, removal.loserRemoved);
         auditConflictResolve(db, target, removal, tenantId);
         db.exec('COMMIT');
-        syncMirrorFiles(hippoRoot, db);
+        syncChangedMirrors(hippoRoot, db, [...selectEntriesByIds(db, [keepId, loserId]).values()]);
         if (removal.loserRemoved)
             purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal);
         return { conflict: { ...conflict, status: 'resolved' }, loserId };

package/dist/store/delete-and-batch.d.ts

@@ -1,25 +1,16 @@
 import { type MemoryEntry } from '../memory.js';
-import { openHippoDb } from '../db.js';
+import { openHippoDb, type DatabaseSyncLike } from '../db.js';
 import { type DormantMove } from '../dormant.js';
 /** Tables whose rows keep a first-class object's backing memory in `memory_id` (ON DELETE SET NULL); tests/dormant-memories.test.ts pins it to the schema. */
 export declare const MEMORY_BACKED_TABLES: readonly ["predictions", "decisions", "incidents", "processes", "policies", "skills", "project_briefs", "customer_notes"];
 /** Ids of memories that back a first-class object, for passes that plan deletes before making them. A table missing from an older schema is skipped. */
 export declare function memoriesBackingObjects(hippoRoot: string): Set<string>;
 /**
- * AT1 (plan §4, round-2 fix, designed from source): db-scoped delete core.
- * `deleteEntry` used to open+close its OWN connection, which meant it could
- * never compose inside a caller's transaction (unlike writeEntry/
- * writeEntryDbOnly, which already split this way). Split identically: row-
- * meta SELECT, `DELETE FROM memories`, FTS delete, `forget` audit, DAG
- * dirty-mark. NO filesystem I/O — the caller's own transaction may still be
- * rolled back, and mirror writes must only happen post-commit.
+ * db-scoped delete core, so a delete can compose inside a caller's transaction.
+ * NO filesystem I/O: the caller's transaction may still roll back, and mirrors are written post-commit.
  *
- * `opts.suppressForgetAudit` (default false, off): two AT1 callers set this
- * so a removed non-raw row does NOT ALSO emit a `forget` row, because each
- * already writes its own aggregate audit trail — `src/reject-flow.ts`'s
- * `rejectValue` (single `reject_value` row covering every same-digest row
- * removed) and `resolveConflict` (`conflict_resolve` row per resolution).
- * Default keeps `deleteEntry` byte-identical to its pre-split behavior.
+ * `opts.suppressForgetAudit` (default false): `rejectValue` and `resolveConflict` set it because each
+ * writes its own aggregate audit row, so a removed row must not ALSO emit a `forget` row.
  *
  * Returns `{tenantId, dagParentId}` for the removed row, or `null` if no row with `id`
  * existed or `automatic` refused it (pinned, raw, kept for good or backing an object at DELETE time, so a late pin wins).
@@ -49,6 +40,12 @@ export declare function deleteEntry(hippoRoot: string, id: string, opts?: {
     reason?: string;
     automatic?: boolean;
 }): boolean;
+/** deleteEntry on the caller's open store, so a loop of deletes opens the store once; each delete still commits alone. */
+export declare function deleteEntryOn(db: DatabaseSyncLike, hippoRoot: string, id: string, opts?: {
+    actor?: string;
+    reason?: string;
+    automatic?: boolean;
+}): boolean;
 /** Consolidation's flush, one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
  *  the fields the caller changed, takes the rest from the live row, and never resurrects a row that is gone.
  *