hippo-memory 1.62.0 → 1.63.1

package/dist/dag.js

@@ -87,13 +87,9 @@ export async function generateDagSummary(label, factContents, opts) {
         return null;
     }
 }
-// Hardening follow-up (mirrors consolidate.ts's mergeCandidatesByTenant,
-// T1): partition unparented facts by tenantId BEFORE clustering so a
-// cluster can never mix facts from different tenants into one
-// LLM-synthesized summary. Map preserves insertion order, so
-// single-tenant stores (every row 'default') get exactly one partition
-// and iterate in the same order as before this fix — byte-identical
-// behavior there.
+// Partition BEFORE clustering so one LLM summary never mixes facts from different tenants.
+// Map keeps insertion order, so a single-tenant store iterates in its original order.
+// buildEntityProfiles partitions its L2s with this same key.
 function partitionFactsByTenant(unparented) {
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
@@ -123,9 +119,8 @@ function createClusterSummaryEntry(summary, cluster, home) {
         baseHalfLifeDays: home.baseHalfLifeDays,
     });
     summaryEntry.origin_project = home.originProject;
-    // Schema v25: cache descendant_count + earliest/latest_at on the summary
-    // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
-    // can reason about scope without walking the children.
+    // Cache descendant_count + earliest/latest_at on the summary row so
+    // DAG-aware recall can reason about scope without walking the children.
     summaryEntry.descendant_count = cluster.members.length;
     summaryEntry.earliest_at = memberCreatedAts[0];
     summaryEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
@@ -137,21 +132,8 @@ async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
     if (!summary)
         return;
     const summaryEntry = createClusterSummaryEntry(summary, cluster, home);
-    // AT1 (plan §3 containment): a refused LLM-synthesized summary skips
-    // ONLY this cluster — the sleep cycle continues to the next one. The
-    // member re-parenting writes below never run for a skipped cluster
-    // (there is no summary id to parent them under).
-    //
-    // The tombstone check itself is tenant-scoped for free: writeEntry ->
-    // writeEntryDbOnly -> upsertEntryRow calls
-    // checkRejectionGuard(db, entry.tenantId ?? 'default', ...)
-    // (store/entry-writes.ts), reading tenantId off the entry being written. Now
-    // that summaryEntry carries home.tenantId instead of the implicit
-    // 'default', the guard consults that tenant's tombstones — no
-    // separate check needed here (unlike consolidate.ts's merge pass,
-    // which pre-checks via findRejectedValue because it writes through
-    // batchWriteAndDelete's bypassRejectionGuard path instead of
-    // writeEntry).
+    // A refused summary skips only this cluster. writeEntry's guard reads tenantId off the entry
+    // (home.tenantId), so it already checks this tenant's tombstones: no separate check here.
     try {
         writeEntry(hippoRoot, summaryEntry);
     }
@@ -169,11 +151,8 @@ async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
         writeEntry(hippoRoot, updated);
         result.factsLinked++;
     }
-    // v0.30 / E3 — cancel the cascade of dirty-marks fired by member
-    // writeEntry calls (E2 hook on writeEntryDbOnly in store/entry-writes.ts).
-    // The summary we just built IS fresh, no rebuild needed. Without this,
-    // E3 in the SAME sleep cycle would re-rebuild every new summary
-    // (2x LLM cost). plan-eng-r1 HIGH must-fix.
+    // Member writes just marked this fresh summary dirty; clear it, or the same sleep cycle's
+    // rebuild pass would re-rebuild every new summary at twice the LLM cost.
     clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
 }
 export async function buildDag(hippoRoot, facts, opts) {
@@ -248,21 +227,17 @@ async function rebuildOneSummary(hippoRoot, summary, opts, result) {
     // success, silently skip
 }
 /**
- * v0.30 / E3 — sleep-cycle phase that drains the dirty L2 summary queue.
+ * Sleep-cycle phase that drains the dirty L2 summary queue.
  * Thin orchestrator; the heavy lifting lives in store.ts (load + apply)
  * and dag.ts:generateDagSummary (LLM call).
  *
- * Per-summary try/catch isolation (plan-eng-r1 MED must-fix) — one
- * throwing rebuild does NOT abort the rest of the queue.
+ * Per-summary try/catch: one throwing rebuild does NOT abort the rest of the queue.
  *
  * Race-loser handling: applyRebuildResult's UPDATE WHERE includes
  * AND summary_dirty=1, so concurrent sleep's second writer returns
  * changed=false. Silent skip (neither rebuilt++ nor refused++ nor failed++).
  *
- * T4: applyRebuildResult returns { changed, refused } — a tombstone hit
- * (rebuild content matches a previously-rejected value) increments
- * `refused`, not `rebuilt`. Dirty still clears either way; only the stat
- * split changed (docs/plans/2026-08-15-hardening-at1-followups.md T4).
+ * A tombstone hit counts as `refused`, not `rebuilt`; dirty clears either way.
  */
 export async function rebuildDirtySummaries(hippoRoot, opts) {
     const cap = opts.cap ?? 20;
@@ -291,33 +266,14 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             await rebuildOneSummary(hippoRoot, summary, opts, result);
         }
         catch (err) {
-            // Per-summary failure isolation — one throw doesn't abort the queue.
-            // independent-review MED #2 fold: log enough to triage in production
-            // (audit() wraps its own writes try/catch per store/audit-event.ts, so a
-            // throw here is exotic: SQLite I/O error, prepare failure, etc).
+            // One throw doesn't abort the queue; log enough to triage an exotic
+            // failure (SQLite I/O, prepare), since audit() already catches its own.
             result.failed++;
             log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return result;
 }
-// independent-review HIGH #1 fold: cluster ONLY within-tenant.
-// clusterFacts has no tenant awareness; without this partition step a
-// multi-tenant host could form a cluster spanning tenants and produce
-// a single L3 with tenantId='default' that doesn't belong to either
-// child tenant. Fix: bucket by tenantId, run clusterFacts per-tenant,
-// pass tenantId to createMemory.
-function partitionL2sByTenant(unparented) {
-    const byTenant = new Map();
-    for (const l2 of unparented) {
-        const tid = l2.tenantId ?? 'default';
-        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
-        const list = byTenant.get(key) ?? [];
-        list.push(l2);
-        byTenant.set(key, list);
-    }
-    return byTenant;
-}
 /** The L3 profile entry for one cluster of L2 summaries. */
 function createProfileEntry(summary, cluster, home) {
     const memberCreatedAts = cluster.members.map((m) => m.created).sort();
@@ -327,7 +283,7 @@ function createProfileEntry(summary, cluster, home) {
         tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
         confidence: 'inferred',
         dag_level: 3,
-        tenantId: home.tenantId, // HIGH #1 fold: thread tenant explicitly
+        tenantId: home.tenantId,
         scope: home.scope,
         baseHalfLifeDays: home.baseHalfLifeDays,
     });
@@ -346,9 +302,7 @@ async function profileCluster(hippoRoot, cluster, home, opts, result) {
         return;
     }
     const profileEntry = createProfileEntry(summary, cluster, home);
-    // AT1 (plan §3 containment): per-cluster catch — skip this cluster,
-    // count, log once. The member re-linking writes below never run for a
-    // skipped cluster (mirrors buildDag above).
+    // A refused profile skips only this cluster; the re-linking below never runs for it.
     try {
         writeEntry(hippoRoot, profileEntry);
     }
@@ -366,21 +320,17 @@ async function profileCluster(hippoRoot, cluster, home, opts, result) {
         writeEntry(hippoRoot, updated);
         result.l2sLinked++;
     }
-    // E3 born-dirty cancellation, same dance as buildDag L161-168 but for
-    // L3. Pass source='buildEntityProfiles-clean' to distinguish in audit.
-    // Args: (root, id, tenantId, actor, source).
+    // Re-linking just marked the fresh L3 dirty; clear it so this cycle's rebuild skips it.
+    // The distinct source tags the audit row.
     clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, home.tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
 }
 /**
- * v0.30 / E5 — build L3 entity profiles by clustering L2 summaries with
+ * Build L3 entity profiles by clustering L2 summaries with
  * shared entity tags. Threshold 2+ L2s per entity. Mirrors buildDag L1->L2
  * pattern, one level up.
  *
- * Born-dirty cancellation (E3 lesson): after linking L2 children to the new
- * L3 (each link write fires E2 hook on L3 via widened markSummaryDirtyInTx),
- * call clearSummaryDirtyAfterBuild with source='buildEntityProfiles-clean'
- * so E3 sleep-cycle rebuild doesn't re-rebuild the freshly-built L3 this
- * same cycle.
+ * Born-dirty cancellation: each L2 link write marks the new L3 dirty, so clear it
+ * or the same sleep cycle's rebuild re-rebuilds the freshly built L3.
  */
 export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const result = {
@@ -393,9 +343,9 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
     // Only L2 with no L3 parent yet (avoid re-clustering already-profiled L2s).
     const unparented = l2Summaries.filter((s) => s.dag_level === 2 && !s.dag_parent_id);
-    for (const [, tenantL2s] of partitionL2sByTenant(unparented)) {
+    for (const [, tenantL2s] of partitionFactsByTenant(unparented)) {
         const home = {
-            tenantId: tenantL2s[0].tenantId ?? 'default',
+            tenantId: tenantL2s[0].tenantId,
             scope: derivationScope(tenantL2s[0].scope),
             originProject: tenantL2s[0].origin_project,
             baseHalfLifeDays,

package/dist/db/continuity.d.ts

@@ -1,5 +1,10 @@
 import type { DatabaseSyncLike } from './sqlite.js';
 export declare const MEMORY_QUARANTINE_DDL = "\n    CREATE TABLE IF NOT EXISTS memory_quarantine (\n      tenant_id      TEXT NOT NULL DEFAULT 'default',\n      memory_id      TEXT NOT NULL,\n      original_scope TEXT,\n      reason         TEXT NOT NULL,\n      status         TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected')),\n      quarantined_at TEXT NOT NULL,\n      decided_at     TEXT,\n      decided_by     TEXT,\n      PRIMARY KEY (tenant_id, memory_id)\n    ) WITHOUT ROWID;\n    CREATE INDEX IF NOT EXISTS idx_memory_quarantine_status\n      ON memory_quarantine(tenant_id, status, quarantined_at DESC);\n";
 export declare function ensureContinuityTables(db: DatabaseSyncLike): void;
+export declare const MEMORIES_FTS_DDL = "CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(id UNINDEXED, content, tags)";
+/** Names of every table and index a `CREATE ... IF NOT EXISTS` in `ddl` makes. */
+export declare function createdObjectNames(ddl: string): string[];
+/** Every object runMigrations re-asserts on a stamped store; the open fast path requires all of them. */
+export declare const REQUIRED_SCHEMA_OBJECTS: readonly string[];
 export declare function ensureContinuityIndexes(db: DatabaseSyncLike): void;
 //# sourceMappingURL=continuity.d.ts.map

package/dist/db/continuity.js

@@ -1,3 +1,4 @@
+import { META_TABLE_DDL } from './meta.js';
 // Shared by migration v48 and the stamped-store self-heal below.
 export const MEMORY_QUARANTINE_DDL = `
     CREATE TABLE IF NOT EXISTS memory_quarantine (
@@ -112,34 +113,51 @@ const CARD_COMMENTS_DDL = `
       tenant_id TEXT NOT NULL DEFAULT 'default'
     )
   `;
-// Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
-// incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
+// Before the loop on stamped stores: a table lost after its migration stamped
+// is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
 export function ensureContinuityTables(db) {
-    db.exec(TASK_SNAPSHOTS_DDL);
-    db.exec(SESSION_EVENTS_DDL);
-    db.exec(SESSION_HANDOFFS_DDL);
-    db.exec(CARDS_DDL);
-    db.exec(CARD_DEPS_DDL);
-    db.exec(CARD_RUNS_DDL);
-    db.exec(CARD_COMMENTS_DDL);
-    db.exec(MEMORY_QUARANTINE_DDL);
+    for (const ddl of CONTINUITY_TABLE_DDL)
+        db.exec(ddl);
 }
+const CONTINUITY_TABLE_DDL = [
+    TASK_SNAPSHOTS_DDL,
+    SESSION_EVENTS_DDL,
+    SESSION_HANDOFFS_DDL,
+    CARDS_DDL,
+    CARD_DEPS_DDL,
+    CARD_RUNS_DDL,
+    CARD_COMMENTS_DDL,
+    MEMORY_QUARANTINE_DDL,
+];
+const CONTINUITY_INDEX_DDL = [
+    `CREATE INDEX IF NOT EXISTS idx_task_snapshots_status_updated ON task_snapshots(status, updated_at DESC, id DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_status ON task_snapshots(tenant_id, status, updated_at DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_scope ON task_snapshots(tenant_id, scope, status)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_events_session_created ON session_events(session_id, created_at DESC, id DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_events_task_created ON session_events(task, created_at DESC, id DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_handoffs_session ON session_handoffs(session_id, created_at DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_outcome ON session_handoffs(tenant_id, outcome, created_at DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_cards_tenant_status ON cards(tenant_id, status, updated_at DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_child ON card_deps(tenant_id, child)`,
+    `CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_parent ON card_deps(tenant_id, parent)`,
+    `CREATE INDEX IF NOT EXISTS idx_card_runs_tenant_card ON card_runs(tenant_id, card, started DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_card_comments_tenant_card ON card_comments(tenant_id, card_id, created_at DESC)`,
+    `CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_card ON session_handoffs(tenant_id, card_id, created_at DESC)`,
+];
+// Lives with the other re-asserted DDL so the required-object list below derives from one place.
+export const MEMORIES_FTS_DDL = `CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(id UNINDEXED, content, tags)`;
+const CREATED_NAME = /CREATE\s+(?:VIRTUAL\s+)?(?:TABLE|INDEX)\s+IF\s+NOT\s+EXISTS\s+(\w+)/gi;
+/** Names of every table and index a `CREATE ... IF NOT EXISTS` in `ddl` makes. */
+export function createdObjectNames(ddl) {
+    return [...ddl.matchAll(CREATED_NAME)].map((m) => m[1]);
+}
+/** Every object runMigrations re-asserts on a stamped store; the open fast path requires all of them. */
+export const REQUIRED_SCHEMA_OBJECTS = Object.freeze([META_TABLE_DDL, ...CONTINUITY_TABLE_DDL, ...CONTINUITY_INDEX_DDL, MEMORIES_FTS_DDL].flatMap(createdObjectNames));
 // After the loop: tenant_id (v16) and scope (v23) do not exist yet on a genuine old store.
 export function ensureContinuityIndexes(db) {
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_status_updated ON task_snapshots(status, updated_at DESC, id DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_status ON task_snapshots(tenant_id, status, updated_at DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_scope ON task_snapshots(tenant_id, scope, status)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_session_created ON session_events(session_id, created_at DESC, id DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_task_created ON session_events(task, created_at DESC, id DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_session ON session_handoffs(session_id, created_at DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_outcome ON session_handoffs(tenant_id, outcome, created_at DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_cards_tenant_status ON cards(tenant_id, status, updated_at DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_child ON card_deps(tenant_id, child)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_parent ON card_deps(tenant_id, parent)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_runs_tenant_card ON card_runs(tenant_id, card, started DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_card_comments_tenant_card ON card_comments(tenant_id, card_id, created_at DESC)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_card ON session_handoffs(tenant_id, card_id, created_at DESC)`);
+    for (const ddl of CONTINUITY_INDEX_DDL)
+        db.exec(ddl);
 }
 //# sourceMappingURL=continuity.js.map

package/dist/db/meta.d.ts

@@ -1,4 +1,5 @@
 import type { DatabaseSyncLike } from './sqlite.js';
+export declare const META_TABLE_DDL = "\n    CREATE TABLE IF NOT EXISTS meta (\n      key TEXT PRIMARY KEY,\n      value TEXT NOT NULL\n    );\n  ";
 export declare function ensureMetaTable(db: DatabaseSyncLike): void;
 export declare function getSchemaVersion(db: DatabaseSyncLike): number;
 export declare function setSchemaVersion(db: DatabaseSyncLike, version: number): void;

package/dist/db/meta.js

@@ -1,11 +1,12 @@
 import { tableExists } from './tables.js';
-export function ensureMetaTable(db) {
-    db.exec(`
+export const META_TABLE_DDL = `
     CREATE TABLE IF NOT EXISTS meta (
       key TEXT PRIMARY KEY,
       value TEXT NOT NULL
     );
-  `);
+  `;
+export function ensureMetaTable(db) {
+    db.exec(META_TABLE_DDL);
 }
 export function getSchemaVersion(db) {
     if (!tableExists(db, 'meta'))

package/dist/db/migrate.d.ts

@@ -5,5 +5,14 @@ export declare class IncompatibleBinaryError extends Error {
 }
 /** Refuse a store stamped for a newer binary. Fails closed: runMigrations creates meta first, so a failed read is a real error. */
 export declare function assertBinaryCompatible(db: DatabaseSyncLike): void;
+/** The fast path's single probe: versions, the binary minimum, the FTS flag, and counts of the meta defaults and required objects. */
+export declare const SCHEMA_PROBE_SQL: string;
 export declare function runMigrations(db: DatabaseSyncLike, hippoRoot?: string, busyWaitMs?: number): void;
+/** Row counts of `memories` and its full-text index, which differ once the index drifts; null when either table is missing. */
+export declare function ftsRowCounts(db: DatabaseSyncLike): {
+    memories: number;
+    fts: number;
+} | null;
+/** Re-syncs `memories_fts` with `memories` when their counts differ and returns whether it did; sleep runs it because a fast open does not. */
+export declare function repairFtsDrift(db: DatabaseSyncLike): boolean;
 //# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.js

@@ -4,7 +4,7 @@ import { importLegacyEmbeddingIndex } from '../vector-store.js';
 import { execWithBusyRetry } from './busy.js';
 import { tableExists } from './tables.js';
 import { ensureMetaTable, getMeta, getSchemaVersion, setMeta, setSchemaVersion } from './meta.js';
-import { ensureContinuityIndexes, ensureContinuityTables } from './continuity.js';
+import { MEMORIES_FTS_DDL, REQUIRED_SCHEMA_OBJECTS, ensureContinuityIndexes, ensureContinuityTables } from './continuity.js';
 import { CURRENT_SCHEMA_VERSION, MIGRATIONS } from './migrations/index.js';
 export function getCurrentSchemaVersion() {
     return CURRENT_SCHEMA_VERSION;
@@ -12,15 +12,64 @@ export function getCurrentSchemaVersion() {
 /** Thrown by {@link assertBinaryCompatible}; doctor uses it to pick the upgrade fix over a generic permissions fix. */
 export class IncompatibleBinaryError extends Error {
 }
-/** Refuse a store stamped for a newer binary. Fails closed: runMigrations creates meta first, so a failed read is a real error. */
-export function assertBinaryCompatible(db) {
-    const minRequired = getMeta(db, 'min_compatible_binary');
+function assertMinBinary(minRequired) {
     if (minRequired && compareSemver(minRequired, PACKAGE_VERSION) > 0) {
         throw new IncompatibleBinaryError(`hippo-memory: this database requires hippo-memory >= ${minRequired}, but the running binary is ${PACKAGE_VERSION}. ` +
             `Upgrade hippo-memory to open it; an older binary does not know this schema and could expose private rows or damage the store.`);
     }
 }
+/** Refuse a store stamped for a newer binary. Fails closed: runMigrations creates meta first, so a failed read is a real error. */
+export function assertBinaryCompatible(db) {
+    assertMinBinary(getMeta(db, 'min_compatible_binary'));
+}
+const META_DEFAULTS = [
+    ['schema_version', String(CURRENT_SCHEMA_VERSION)],
+    ['last_retrieval_ids', '[]'],
+    ['last_trace_id', ''],
+    ['total_remembered', '0'],
+    ['total_recalled', '0'],
+    ['total_forgotten', '0'],
+    ['fts5_available', '0'],
+];
+// Names come from our own constants and match \w+, so inlining them as literals is safe.
+const sqlList = (names) => names.map((n) => `'${n}'`).join(', ');
+/** The fast path's single probe: versions, the binary minimum, the FTS flag, and counts of the meta defaults and required objects. */
+export const SCHEMA_PROBE_SQL = `SELECT
+  (SELECT user_version FROM pragma_user_version) AS user_version,
+  (SELECT value FROM meta WHERE key = 'schema_version') AS schema_version,
+  (SELECT value FROM meta WHERE key = 'min_compatible_binary') AS min_binary,
+  (SELECT value FROM meta WHERE key = 'fts5_available') AS fts5,
+  (SELECT COUNT(*) FROM meta WHERE key IN (${sqlList(META_DEFAULTS.map(([key]) => key))})) AS meta_keys,
+  (SELECT COUNT(*) FROM sqlite_master WHERE type IN ('table', 'index') AND name IN (${sqlList(REQUIRED_SCHEMA_OBJECTS)})) AS objects`;
+/** True when the store is current and whole, so the open can skip every DDL statement. Runs the binary check either way. */
+function schemaIsCurrent(db) {
+    let probe;
+    try {
+        // SAFETY: the SELECT names exactly these six columns and always returns one row.
+        probe = db.prepare(SCHEMA_PROBE_SQL).get();
+    }
+    catch (err) {
+        // A store with no meta table yet is the slow path's job; anything else is a real error.
+        if (err instanceof Error && /no such table: meta/.test(err.message))
+            return false;
+        throw err;
+    }
+    if (!probe)
+        return false;
+    assertMinBinary(probe.min_binary);
+    return Number(probe.user_version) === CURRENT_SCHEMA_VERSION
+        && Number(probe.schema_version) === CURRENT_SCHEMA_VERSION
+        && Number(probe.meta_keys) === META_DEFAULTS.length
+        && Number(probe.objects) === REQUIRED_SCHEMA_OBJECTS.length
+        && probe.fts5 === '1';
+}
 export function runMigrations(db, hippoRoot, busyWaitMs) {
+    if (!schemaIsCurrent(db))
+        migrateAndHeal(db, hippoRoot, busyWaitMs);
+    if (hippoRoot)
+        importLegacyVectors(db, hippoRoot);
+}
+function migrateAndHeal(db, hippoRoot, busyWaitMs) {
     ensureMetaTable(db);
     // Before anything writes, so a stale binary never repairs or migrates a store it does not understand.
     assertBinaryCompatible(db);
@@ -30,36 +79,46 @@ export function runMigrations(db, hippoRoot, busyWaitMs) {
     for (const migration of MIGRATIONS) {
         if (migration.version <= currentVersion)
             continue;
-        execWithBusyRetry(db, 'BEGIN IMMEDIATE', busyWaitMs);
-        try {
-            // A newer binary may have migrated and raised the minimum while we waited for the lock.
-            assertBinaryCompatible(db);
-            // Re-read under the write lock: another process may have applied this
-            // migration while we waited, and re-running one is not idempotent.
-            const applied = getSchemaVersion(db);
-            if (applied >= migration.version) {
-                db.exec('COMMIT');
-                currentVersion = applied;
-                continue;
-            }
-            migration.up(db, { hippoRoot });
-            setSchemaVersion(db, migration.version);
-            db.exec('COMMIT');
-            currentVersion = migration.version;
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* already rolled back; keep the original error */ }
-            throw error;
-        }
+        currentVersion = applyMigration(db, migration, hippoRoot, busyWaitMs);
     }
+    healUserVersion(db, currentVersion, busyWaitMs);
     ensureContinuityIndexes(db);
     ensureMetaDefaults(db);
     ensureOptionalFts(db);
-    if (hippoRoot)
-        importLegacyVectors(db, hippoRoot);
+}
+/** Applies one migration under the write lock and returns the version the store is now at. */
+function applyMigration(db, migration, hippoRoot, busyWaitMs) {
+    execWithBusyRetry(db, 'BEGIN IMMEDIATE', busyWaitMs);
+    try {
+        // A newer binary may have migrated and raised the minimum while we waited for the lock.
+        assertBinaryCompatible(db);
+        // Re-read under the write lock: another process may have applied this
+        // migration while we waited, and re-running one is not idempotent.
+        const applied = getSchemaVersion(db);
+        if (applied >= migration.version) {
+            db.exec('COMMIT');
+            return applied;
+        }
+        migration.up(db, { hippoRoot });
+        setSchemaVersion(db, migration.version);
+        db.exec('COMMIT');
+        return migration.version;
+    }
+    catch (error) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { /* already rolled back; keep the original error */ }
+        throw error;
+    }
+}
+// The fast path requires user_version as well, and a store stamped only in meta would otherwise never reach it.
+function healUserVersion(db, version, busyWaitMs) {
+    // SAFETY: PRAGMA user_version returns one row with one integer column.
+    const row = db.prepare('PRAGMA user_version').get();
+    const target = Math.max(0, Math.trunc(version));
+    if (Number(row?.user_version ?? 0) < target)
+        execWithBusyRetry(db, `PRAGMA user_version = ${target}`, busyWaitMs);
 }
 // A failed import leaves embeddings.json in place for the next open to retry; the store still opens.
 function importLegacyVectors(db, hippoRoot) {
@@ -71,27 +130,18 @@ function importLegacyVectors(db, hippoRoot) {
     }
 }
 function ensureMetaDefaults(db) {
-    const defaults = [
-        ['schema_version', String(CURRENT_SCHEMA_VERSION)],
-        ['last_retrieval_ids', '[]'],
-        ['last_trace_id', ''],
-        ['total_remembered', '0'],
-        ['total_recalled', '0'],
-        ['total_forgotten', '0'],
-        ['fts5_available', '0'],
-    ];
     // Read-first: an already-current store has all 7 keys, so this is one
     // SELECT and zero writes instead of 7 no-op INSERT OR IGNOREs, each of
     // which takes a RESERVED lock even when nothing changes.
-    const keys = defaults.map(([key]) => key);
+    const keys = META_DEFAULTS.map(([key]) => key);
     const present = new Set(db
         .prepare(`SELECT key FROM meta WHERE key IN (${keys.map(() => '?').join(',')})`)
         .all(...keys)
         .map((r) => r.key));
-    if (present.size === defaults.length)
+    if (present.size === META_DEFAULTS.length)
         return;
     const stmt = db.prepare(`INSERT OR IGNORE INTO meta(key, value) VALUES (?, ?)`);
-    for (const [key, value] of defaults) {
+    for (const [key, value] of META_DEFAULTS) {
         if (!present.has(key))
             stmt.run(key, value);
     }
@@ -99,8 +149,8 @@ function ensureMetaDefaults(db) {
 function ensureOptionalFts(db) {
     let available = false;
     try {
-        db.exec(`CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(id UNINDEXED, content, tags)`);
-        backfillFtsIndex(db);
+        db.exec(MEMORIES_FTS_DDL);
+        repairFtsDrift(db);
         available = true;
     }
     catch (err) {
@@ -112,16 +162,23 @@ function ensureOptionalFts(db) {
     if (getMeta(db, 'fts5_available') !== flag)
         setMeta(db, 'fts5_available', flag);
 }
-function backfillFtsIndex(db) {
-    // SAFETY: this get() result's shape matches the single aliased `c` column
-    // named in the SELECT above.
-    const memCount = db.prepare(`SELECT COUNT(*) AS c FROM memories`).get()?.c ?? 0;
-    // SAFETY: this get() result's shape matches the single aliased `c` column named in the SELECT above.
+/** Row counts of `memories` and its full-text index, which differ once the index drifts; null when either table is missing. */
+export function ftsRowCounts(db) {
+    if (!tableExists(db, 'memories_fts') || !tableExists(db, 'memories'))
+        return null;
+    // SAFETY: this get() result's shape matches the single aliased `c` column named in the SELECT.
+    const memories = db.prepare(`SELECT COUNT(*) AS c FROM memories`).get()?.c ?? 0;
     // memories_fts_docsize is FTS5's cheaper one-row-per-document shadow table; fall back for a foreign-built index.
     const ftsTable = tableExists(db, 'memories_fts_docsize') ? 'memories_fts_docsize' : 'memories_fts';
-    const ftsCount = db.prepare(`SELECT COUNT(*) AS c FROM ${ftsTable}`).get()?.c ?? 0;
-    if (memCount === ftsCount)
-        return;
+    // SAFETY: this get() result's shape matches the single aliased `c` column named in the SELECT.
+    const fts = db.prepare(`SELECT COUNT(*) AS c FROM ${ftsTable}`).get()?.c ?? 0;
+    return { memories: Number(memories), fts: Number(fts) };
+}
+/** Re-syncs `memories_fts` with `memories` when their counts differ and returns whether it did; sleep runs it because a fast open does not. */
+export function repairFtsDrift(db) {
+    const counts = ftsRowCounts(db);
+    if (counts === null || counts.memories === counts.fts)
+        return false;
     db.exec(`
     INSERT INTO memories_fts(id, content, tags)
     SELECT m.id, m.content, m.tags_json
@@ -134,5 +191,6 @@ function backfillFtsIndex(db) {
     DELETE FROM memories_fts
     WHERE id NOT IN (SELECT id FROM memories)
   `);
+    return true;
 }
 //# sourceMappingURL=migrate.js.map

package/dist/db/migrations/v14.js

@@ -2,7 +2,7 @@ import { tableHasColumn } from '../tables.js';
 export const v14 = {
     version: 14,
     up: (db) => {
-        // A3 provenance envelope: kind, scope, owner, artifact_ref.
+        // Provenance envelope: kind, scope, owner, artifact_ref.
         // SQLite ALTER TABLE ADD COLUMN cannot add CHECK; CHECK enforcement lives
         // in INSERT/UPDATE triggers added later in this migration.
         if (!tableHasColumn(db, 'memories', 'kind')) {

package/dist/db/migrations/v15.js

@@ -1,8 +1,7 @@
 export const v15 = {
     version: 15,
     up: (db) => {
-        // A3 hardening (post-review): close the NULL-kind bypass and add raw_archive
-        // dedup safety. Both findings landed in /review on commits 41b1f4d..6456e7d.
+        // Close the NULL-kind bypass and add raw_archive dedup safety.
         //
         // (1) Original v14 triggers used `WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN (...)`.
         //     A direct INSERT/UPDATE setting kind=NULL bypassed the CHECK substitute. Replace

package/dist/db/migrations/v16.js

@@ -2,9 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v16 = {
     version: 16,
     up: (db) => {
-        // A5 stub auth: add tenant_id to all data tables. Single-tenant per deployment;
-        // multi-tenant enforcement deferred to v2 (full A5). The columns are needed now
-        // so future B-track tables don't have to backfill.
+        // Stub auth: add tenant_id to all data tables. Single-tenant per deployment for now;
+        // the columns land early so later tables don't have to backfill.
         if (!tableHasColumn(db, 'memories', 'tenant_id')) {
             db.exec(`ALTER TABLE memories ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
         }
@@ -26,7 +25,7 @@ export const v16 = {
         db.exec(`CREATE INDEX IF NOT EXISTS idx_working_memory_tenant ON working_memory(tenant_id, importance DESC, created_at DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_consolidation_runs_tenant_ts ON consolidation_runs(tenant_id, timestamp DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_status ON task_snapshots(tenant_id, status, updated_at DESC)`);
-        // A5 stub auth: api_keys (scrypt-hashed; plaintext returned to caller exactly once)
+        // Stub auth: api_keys (scrypt-hashed; plaintext returned to caller exactly once)
         // and audit_log (append-only mutation trail). Both carry tenant_id from day 1 so
         // future multi-tenant enforcement is a config flip, not a re-migration.
         db.exec(`

package/dist/db/migrations/v17.js

@@ -1,8 +1,7 @@
 export const v17 = {
     version: 17,
     up: (db) => {
-        // E1.3 Slack ingestion: idempotency log, per-channel backfill cursors, DLQ.
-        // See docs/plans/2026-04-29-e1.3-slack-ingestion.md.
+        // Slack ingestion: idempotency log, per-channel backfill cursors, DLQ.
         db.exec(`
         CREATE TABLE IF NOT EXISTS slack_event_log (
           event_id TEXT PRIMARY KEY,
@@ -31,7 +30,7 @@ export const v17 = {
         )
       `);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_slack_dlq_tenant_received ON slack_dlq(tenant_id, received_at)`);
-        // Multi-tenant routing seam (review patch #6). Empty by default — single-
+        // Multi-tenant routing seam. Empty by default: single-
         // tenant deployments resolve via HIPPO_TENANT fallback. Multi-workspace
         // deployments populate this table to map team_id → tenant_id.
         db.exec(`

package/dist/db/migrations/v19.js

@@ -2,7 +2,7 @@ import { tableHasColumn } from '../tables.js';
 export const v19 = {
     version: 19,
     up: (db) => {
-        // v0.39 commit 3 (Slack hardening): widen slack_dlq with bucketing,
+        // Slack hardening: widen slack_dlq with bucketing,
         // retry tracking, and the signature/timestamp pair that lets `hippo
         // slack dlq replay` re-verify before re-running ingest. ALTER ADD
         // COLUMN with DEFAULT is non-destructive — legacy rows take the

package/dist/db/migrations/v20.js

@@ -1,7 +1,7 @@
 export const v20 = {
     version: 20,
     up: (db) => {
-        // v0.39 commit 4 (GDPR Path A backfill): redact every existing
+        // GDPR Path A backfill: redact every existing
         // raw_archive.payload_json so historical archives match the new
         // metadata-only contract from src/raw-archive.ts. Read each row, parse
         // the existing JSON to extract tenant_id and kind (best effort), then