hippo-memory 1.63.1 → 1.64.0

package/dist/shared.js

@@ -15,18 +15,20 @@ import { loadAllEntries, readEntry } from './store/entry-reads.js';
 import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from './store/search-rows.js';
 import { tallySources } from './store/candidates.js';
 import { loadIndex } from './store/index-and-stats.js';
-import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from './recall-scope.js';
+import { isPersonalScope, passesScopeFilterForRecall, passesCliRecallScopeFilter } from './recall-scope.js';
 import { search } from './search/bm25-search.js';
 import { hybridSearch } from './search/hybrid.js';
 import { fitBudget } from './search/finalize.js';
 import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from './search/types.js';
 import { evalNow } from './ablation.js';
-import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir, resolveProjectIdentity } from './project-identity.js';
+import { fallbackOrigin, classifyOriginProject, resolveGlobalRootDir, resolveProjectIdentity } from './project-identity.js';
+import { isSharedStore } from './config.js';
 import { detectSecret } from './secret-detect.js';
 import { isQuarantineScope } from './quarantine.js';
 import { RejectedValueError } from './rejection.js';
 import { embedMemory, embedAll } from './embeddings.js';
 import { duplicateKey, storedTextKeys } from './same-text.js';
+import { isReusable } from './memory-quality.js';
 import { log } from './log.js';
 // The rows are already copied; a failed background embed only delays vectors, so it warns instead of throwing.
 function logEmbedAllFailure(caller, err) {
@@ -67,6 +69,9 @@ export function promoteToGlobal(localRoot, id, opts) {
     if (isQuarantineScope(entry.scope)) {
         throw new BadRequestError(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
     }
+    if (isPersonalScope(entry.scope ?? null)) {
+        throw new BadRequestError(`Refusing to promote ${id}: it is a personal memory and stays with its owner on this server.`);
+    }
     // Secret producer veto: promote is a producer path to the global store
     // exactly like shareMemory - same hard rule.
     const promoteSecret = detectSecret(entry);
@@ -76,14 +81,12 @@ export function promoteToGlobal(localRoot, id, opts) {
     }
     initGlobal();
     const globalRoot = getGlobalRoot();
-    // Mint a new ID for the global store. origin_project rides along from the
-    // local entry's write-time stamp via the spread; back-stop it for pre-v39
-    // local rows so a promoted copy never lands NULL in the global store.
+    // A project store's NULL row gets its folder back; a shared store's folder is no caller's project, so NULL stays and the label names no path.
     const globalEntry = {
         ...entry,
         id: generateId('g'),
-        source: `promoted:${localRoot}`,
-        origin_project: entry.origin_project ?? deriveOriginProject(path.dirname(path.resolve(localRoot))),
+        source: isSharedStore(localRoot) ? `shared::${new Date().toISOString()}` : `promoted:${localRoot}`,
+        origin_project: entry.origin_project ?? fallbackOrigin(localRoot),
     };
     writeEntry(globalRoot, globalEntry, { actor: opts?.actor, afterWrite: opts?.afterWrite });
     // Fire-and-forget: embedMemory gates on availability and never rejects.
@@ -161,19 +164,19 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
         if (!fs.existsSync(root))
             return [];
         return recallScope
-            ? loadRecallSearchEntries(root, query, searchWindow, tenantId, recallScope.requested, recallScope.additive ? 'additive' : 'exact', Boolean(includeSuperseded) || Boolean(asOf))
+            ? loadRecallSearchEntries(root, query, searchWindow, tenantId, recallScope.requested, recallScope.additive ? 'additive' : 'exact', Boolean(includeSuperseded) || Boolean(asOf), undefined, recallScope.ownScope)
             : loadSearchEntries(root, query, searchWindow, tenantId);
     };
     const passesScope = (e) => !recallScope || (recallScope.additive
-        ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested)
-        : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested));
+        ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested) || passesScopeFilterForRecall(e.scope ?? null, undefined, recallScope.ownScope)
+        : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested, recallScope.ownScope));
     const admit = (e) => passesScope(e) && (!entryFilter || entryFilter(e));
     const localEntries = loadEntries(localRoot).filter(admit);
     const globalEntries = loadEntries(globalRoot).filter(admit);
     // The vector arm loads under the same SQL rules as loadEntries, then the same JS admission.
     const vectorCandidates = {
         tenantId,
-        scope: recallScope ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact') : undefined,
+        scope: recallScope ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact', recallScope.ownScope) : undefined,
         includeSuperseded: !recallScope || Boolean(includeSuperseded) || Boolean(asOf),
         admit,
     };
@@ -292,20 +295,22 @@ export function shareMemory(localRoot, id, options = {}) {
     if (isQuarantineScope(entry.scope)) {
         throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
     }
+    if (isPersonalScope(entry.scope ?? null)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is a personal memory and stays with its owner on this server.`);
+    }
     const score = transferScore(entry);
     if (score < 0.3 && !options.force)
         return null;
     initGlobal();
     const globalRoot = getGlobalRoot();
-    // v39: canonical origin comes from the entry's own stamp (write-time,
-    // store-location-derived); the localRoot parent basename is only a
-    // fallback for pre-v39 rows and keeps the legacy source format intact.
+    // The label keeps the folder name for a user-global row; a NULL row gets `shared::`, which originFromSource reads as no project.
     const fallbackName = path.basename(path.resolve(localRoot, '..'));
-    const originName = entry.origin_project ?? deriveOriginProject(path.dirname(path.resolve(localRoot)));
+    const originName = entry.origin_project ?? fallbackOrigin(localRoot);
+    const label = originName === '' ? fallbackName : (originName ?? '');
     const globalEntry = {
         ...entry,
         id: generateId('g'),
-        source: `shared:${originName === '' ? fallbackName : originName}:${new Date().toISOString()}`,
+        source: `shared:${label}:${new Date().toISOString()}`,
         origin_project: originName,
     };
     writeEntry(globalRoot, globalEntry);
@@ -365,8 +370,8 @@ export function listPeers(globalRoot, tenantId) {
         .sort((a, b) => b.count - a.count);
 }
 function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
-    // shareMemory refuses quarantined rows; filtering here keeps sleep from aborting on one.
-    if (isQuarantineScope(entry.scope ?? null))
+    // shareMemory refuses quarantined and personal rows; filtering here keeps sleep from aborting on one.
+    if (isQuarantineScope(entry.scope ?? null) || isPersonalScope(entry.scope ?? null) || !isReusable(entry))
         return false;
     // Before the score: these rows describe one project only, and a git seed's 'error' tag clears the bar.
     if (entry.tags.some((t) => NEVER_AUTO_SHARE_TAGS.has(t)) || entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX)) {
@@ -475,6 +480,9 @@ export function autoShare(localRoot, options = {}) {
  * Returns the count of newly copied entries.
  */
 export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
+    if (isSharedStore(localRoot)) {
+        throw new BadRequestError(`Refusing to sync into ${localRoot}: a shared store takes no copies of a personal global store, whose rows would reach every member.`);
+    }
     if (!fs.existsSync(globalRoot))
         return 0;
     // Host-wide read. syncGlobalToLocal copies the global union into a

package/dist/store/candidates.d.ts

@@ -1,7 +1,9 @@
 import type { MemoryEntry, StrengthInputs } from '../memory.js';
+import { type SqlFragment } from '../recall-scope.js';
 export interface AmbientRecallRequest {
     terms: string[];
     limit: number;
+    ownScope?: string;
 }
 export interface AmbientLoadResult {
     entries: MemoryEntry[];
@@ -11,11 +13,18 @@ export interface AmbientLoadResult {
 export declare const AMBIENT_PINNED_WHERE = "pinned = 1 AND superseded_by IS NULL AND tenant_id = ? ORDER BY created ASC, id ASC";
 /** Exported so the plan test runs the exact SQL; idx_memories_created_drift (db.ts v51) serves it. */
 export declare const AMBIENT_DRIFT_SQL = "SELECT 1 FROM memories WHERE superseded_by IS NULL AND tenant_id = ? AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1";
-export declare function loadAmbientCandidates(hippoRoot: string, tenantId: string, recentNeeded: number, admit: (e: MemoryEntry) => boolean, recall?: AmbientRecallRequest): AmbientLoadResult;
+/** The origins a caller's recent rows may carry: its project names, and user-global ('') rows when `userGlobal`. */
+export interface RecentOrigins {
+    readonly names: readonly string[];
+    readonly userGlobal: boolean;
+}
+export declare function loadAmbientCandidates(hippoRoot: string, tenantId: string, recentNeeded: number, admit: (e: MemoryEntry) => boolean, recall?: AmbientRecallRequest, origins?: RecentOrigins): AmbientLoadResult;
 /** The rows a non-pinned context read may admit; each predicate is one getContext's admission applies again in JS. */
 export interface ContextCandidateFilter {
     /** Envelope scope asked for by name; absent applies recall's default deny. */
     exactScope?: string;
+    /** The caller's personal scope, which the default deny admits. */
+    ownScope?: string;
     /** Rows carrying one of these project names, and user-global rows, pass; absent admits every origin. */
     project?: readonly string[];
     /** Most rows returned; past it, the rows decay has worn least win. */
@@ -28,8 +37,10 @@ export declare function loadContextCandidates(hippoRoot: string, tenantId: strin
 export type StrengthRow = StrengthInputs & Pick<MemoryEntry, 'tags'>;
 /** Every tenant row as a StrengthRow, for whole-store health numbers; defaults match rowToEntry's. */
 export declare function loadStrengthRows(hippoRoot: string, tenantId: string): StrengthRow[];
-/** Text and source of tenant rows holding any of `words`; a row equal to a text apart from spacing holds its every word. */
-export declare function loadTextsHoldingWords(hippoRoot: string, tenantId: string, words: readonly string[]): Array<Pick<MemoryEntry, 'content' | 'source'>>;
+export type HeldText = Pick<MemoryEntry, 'content' | 'source' | 'origin_project'>;
+/** Text, source and origin of tenant rows holding any of `words` that `admit` passes, by default the team-visible ones; a row equal to a text apart from spacing holds its every word.
+ *  With `project`, only rows carrying one of those names and user-global rows, as loadContextCandidates' filter. */
+export declare function loadTextsHoldingWords(hippoRoot: string, tenantId: string, words: readonly string[], project?: readonly string[], admit?: SqlFragment): HeldText[];
 export interface SourceTally {
     source: string;
     count: number;

package/dist/store/candidates.js

@@ -1,5 +1,5 @@
 import { closeHippoDb } from '../db.js';
-import { RECALL_DEFAULT_DENY_SCOPES } from '../recall-scope.js';
+import { scopeAdmitSql } from '../recall-scope.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { openStore } from './open.js';
 import { originInSql } from '../project-identity.js';
@@ -9,9 +9,39 @@ const AMBIENT_SCOPED = 'superseded_by IS NULL AND tenant_id = ?';
 export const AMBIENT_PINNED_WHERE = `pinned = 1 AND ${AMBIENT_SCOPED} ORDER BY created ASC, id ASC`;
 /** Exported so the plan test runs the exact SQL; idx_memories_created_drift (db.ts v51) serves it. */
 export const AMBIENT_DRIFT_SQL = `SELECT 1 FROM memories WHERE ${AMBIENT_SCOPED} AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1`;
-// The pins plus the `recentNeeded` newest rows that pass `admit`, for ambient
-// injection. One connection; `recall` piggybacks the prompt-recall FTS query on it too.
-export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit, recall) {
+function inOrigins(e, origins) {
+    const origin = e.origin_project ?? null;
+    return origin === '' ? origins.userGlobal : origin !== null && origins.names.includes(origin);
+}
+// The newest rows `admit` keeps, newest first. The first window stays unfiltered so admit still sees, and the
+// delivery ledger still counts, the other-project rows it refuses; past it, the reads narrow to the caller's origins.
+function loadRecentRows(run, drifted, tenantId, needed, admit, origins) {
+    const keep = origins ? (e) => admit(e) && inOrigins(e, origins) : admit;
+    // `id DESC` mirrors getContext's comparator, not loadFreshRawMemories'
+    // cross-ingest-stable order: that would change what the hook injects.
+    const newest = 'ORDER BY created DESC, id DESC';
+    const window = Math.max(needed * 4, 32);
+    const originSql = origins && (origins.userGlobal ? `(origin_project = '' OR ${originInSql(origins.names)})` : originInSql(origins.names));
+    const ownWhere = originSql ? `${AMBIENT_SCOPED} AND ${originSql}` : AMBIENT_SCOPED;
+    const ownParams = [tenantId, ...(origins?.names ?? [])];
+    if (!drifted) {
+        const windowed = run(`${AMBIENT_SCOPED} ${newest} LIMIT ?`, [tenantId, window]);
+        const kept = windowed.filter(keep);
+        if (kept.length >= needed || windowed.length < window)
+            return kept;
+        if (origins) {
+            const ownWindow = run(`${ownWhere} ${newest} LIMIT ?`, [...ownParams, window]);
+            const ownKept = ownWindow.filter(keep);
+            if (ownKept.length >= needed || ownWindow.length < window)
+                return ownKept;
+        }
+    }
+    // Text order is chronological only for standard UTC ISO (memory.ts), and a window of junk can hide older rows.
+    return run(`${ownWhere} ${newest}`, ownParams).filter(keep);
+}
+// The pins plus the `recentNeeded` newest rows that pass `admit`, for ambient injection. One connection;
+// `recall` piggybacks the prompt-recall FTS query on it too. `origins` narrows the recent rows past the first window.
+export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit, recall, origins) {
     // A SQL LIMIT takes an integer; the Array.slice this replaced truncated one,
     // and include_recent is any non-negative finite number at the HTTP edge.
     const needed = Math.trunc(recentNeeded);
@@ -20,25 +50,13 @@ export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit,
         // SAFETY: every `where` below starts from MEMORY_SELECT_COLUMNS' table.
         const run = (where, params) => db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE ${where}`).all(...params).map(rowToEntry);
         const byId = new Map();
-        const scoped = AMBIENT_SCOPED;
         for (const e of run(AMBIENT_PINNED_WHERE, [tenantId])) {
             if (admit(e))
                 byId.set(e.id, e);
         }
         if (needed > 0) {
-            // Text order is chronological only for canonical UTC ISO (memory.ts).
             const drifted = db.prepare(AMBIENT_DRIFT_SQL).get(tenantId) !== undefined;
-            // `id DESC` mirrors getContext's comparator, not loadFreshRawMemories'
-            // cross-ingest-stable order: that would change what the hook injects.
-            const window = Math.max(needed * 4, 32);
-            const windowed = drifted
-                ? []
-                : run(`${scoped} ORDER BY created DESC, id DESC LIMIT ?`, [tenantId, window]);
-            let kept = windowed.filter(admit);
-            if (drifted || (kept.length < needed && windowed.length === window)) {
-                kept = run(`${scoped} ORDER BY created DESC, id DESC`, [tenantId]).filter(admit);
-            }
-            for (const e of kept)
+            for (const e of loadRecentRows(run, drifted, tenantId, needed, admit, origins))
                 byId.set(e.id, e);
         }
         // loadAllEntries' order: rankedPinned's comparator can tie and Array.sort
@@ -51,7 +69,7 @@ export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit,
             return { entries };
         const ftsQuery = pickRarestFtsQuery(db, recall.terms);
         const recallEntries = ftsQuery
-            ? loadRecallSearchEntriesFromDb(db, ftsQuery, recall.limit, tenantId, undefined, 'exact', false)
+            ? loadRecallSearchEntriesFromDb(db, ftsQuery, recall.limit, tenantId, undefined, 'exact', false, undefined, recall.ownScope)
             : [];
         return { entries, recall: recallEntries };
     }
@@ -74,9 +92,9 @@ export function loadContextCandidates(hippoRoot, tenantId, filter) {
         params.push(filter.exactScope);
     }
     else {
-        // isRestrictedScope's rule; NOT LIKE folds ASCII case as its /:private:/i does.
-        where.push(`(scope IS NULL OR (scope NOT IN (${RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ')}) AND scope NOT LIKE '%:private:%'))`);
-        params.push(...RECALL_DEFAULT_DENY_SCOPES);
+        const admit = scopeAdmitSql('', filter.ownScope);
+        where.push(admit.sql);
+        params.push(...admit.params);
     }
     if (filter.project !== undefined) {
         where.push(`(origin_project = '' OR ${originInSql(filter.project)})`);
@@ -117,19 +135,23 @@ export function loadStrengthRows(hippoRoot, tenantId) {
         closeHippoDb(db);
     }
 }
-/** Text and source of tenant rows holding any of `words`; a row equal to a text apart from spacing holds its every word. */
-export function loadTextsHoldingWords(hippoRoot, tenantId, words) {
+// No owner: for session capture, a personal or connector-private row must never stop a team copy being written.
+const TEAM_VISIBLE = scopeAdmitSql('');
+/** Text, source and origin of tenant rows holding any of `words` that `admit` passes, by default the team-visible ones; a row equal to a text apart from spacing holds its every word.
+ *  With `project`, only rows carrying one of those names and user-global rows, as loadContextCandidates' filter. */
+export function loadTextsHoldingWords(hippoRoot, tenantId, words, project, admit = TEAM_VISIBLE) {
     const unique = [...new Set(words)];
     const out = [];
+    const originWhere = project === undefined ? '' : ` AND (origin_project = '' OR ${originInSql(project)})`;
     const db = openStore(hippoRoot);
     try {
         // Chunked so one statement stays far under SQLite's bound-parameter limit.
         for (let i = 0; i < unique.length; i += 200) {
             const chunk = unique.slice(i, i + 200);
-            // SAFETY: rows' shape matches the two columns named in the SELECT below.
-            const rows = db.prepare(`SELECT content, source FROM memories WHERE tenant_id = ? AND (${chunk.map(() => 'instr(content, ?) > 0').join(' OR ')})`).all(tenantId, ...chunk);
+            // SAFETY: rows' shape matches the three columns named in the SELECT below.
+            const rows = db.prepare(`SELECT content, source, origin_project FROM memories WHERE tenant_id = ?${originWhere} AND ${admit.sql} AND (${chunk.map(() => 'instr(content, ?) > 0').join(' OR ')})`).all(tenantId, ...(project ?? []), ...admit.params, ...chunk);
             for (const row of rows)
-                out.push({ content: row.content, source: row.source ?? 'cli' });
+                out.push({ content: row.content, source: row.source ?? 'cli', origin_project: row.origin_project });
         }
         return out;
     }

package/dist/store/conflicts.d.ts

@@ -1,12 +1,27 @@
+import { type DatabaseSyncLike } from '../db.js';
 import { type MemoryConflict } from './rows.js';
 export declare function listMemoryConflicts(hippoRoot: string, status?: string, tenantId?: string): MemoryConflict[];
+/** Conflicts whose two rows `actor` may both touch; someone else's personal row hides its whole pair. */
+export declare function listTouchableConflicts(hippoRoot: string, status: string, tenantId: string, actor: {
+    owner?: string;
+}): MemoryConflict[];
 type DetectedConflict = {
     memory_a_id: string;
     memory_b_id: string;
     reason: string;
     score: number;
 };
+type SameTenant = (a: string, b: string) => boolean;
 export declare function replaceDetectedConflicts(hippoRoot: string, detected: Array<DetectedConflict>, detectedAt?: string): void;
+/** Every memory's tenant, and each stored conflicts_with_json other than '[]', read before the refresh takes the write lock. */
+export interface ConflictRefreshReads {
+    sameTenant: SameTenant;
+    storedRefs: ReadonlyMap<string, string | null>;
+}
+/** The refresh's read of the whole memories table, kept out of the write lock because it grows with the store. */
+export declare function readConflictRefresh(db: DatabaseSyncLike): ConflictRefreshReads;
+/** Under the write lock: the memory_conflicts rows, then each memory whose refs change; returns the ids it rewrote. */
+export declare function writeConflictRefresh(db: DatabaseSyncLike, reads: ConflictRefreshReads, detected: readonly DetectedConflict[], detectedAt: string): string[];
 /**
  * AT1 (plan §5): additive-optional opts for resolveConflict.
  * `rejectLoserValue` implies removal of the loser regardless of

package/dist/store/conflicts.js

@@ -1,4 +1,4 @@
-import { closeHippoDb } from '../db.js';
+import { closeHippoDb, openHippoDb } from '../db.js';
 import { rejectionDigest, insertRejectedValue, normalizeValueForRejection } from '../rejection.js';
 import { archiveRawMemory } from '../raw-archive.js';
 import { rowToMemoryConflict } from './rows.js';
@@ -7,6 +7,9 @@ import { syncChangedMirrors, purgeMirrorBestEffort } from './mirrors.js';
 import { selectEntriesByIds } from './entry-reads.js';
 import { openStore } from './open.js';
 import { deleteEntryCore } from './delete-and-batch.js';
+import { BadRequestError } from '../api-errors.js';
+import { canTouchScope, isPersonalScope } from '../recall-scope.js';
+import { selectMemoryReach } from './tenant-lookup.js';
 function canonicalConflictPair(aId, bId) {
     return aId < bId
         ? { memory_a_id: aId, memory_b_id: bId }
@@ -70,50 +73,66 @@ export function listMemoryConflicts(hippoRoot, status = 'open', tenantId) {
         closeHippoDb(db);
     }
 }
+/** Conflicts whose two rows `actor` may both touch; someone else's personal row hides its whole pair. */
+export function listTouchableConflicts(hippoRoot, status, tenantId, actor) {
+    const conflicts = listMemoryConflicts(hippoRoot, status, tenantId);
+    const db = openHippoDb(hippoRoot);
+    try {
+        return conflicts.filter((c) => [c.memory_a_id, c.memory_b_id].every((id) => canTouchScope(actor, selectMemoryReach(db, id)?.scope ?? null)));
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 export function replaceDetectedConflicts(hippoRoot, detected, detectedAt = new Date().toISOString()) {
     const db = openStore(hippoRoot);
     try {
-        db.exec('BEGIN');
-        const sameTenant = loadSameTenantCheck(db);
-        const canonicalDetected = detected.map((conflict) => ({
-            ...canonicalConflictPair(conflict.memory_a_id, conflict.memory_b_id),
-            reason: conflict.reason,
-            score: conflict.score,
-        }));
-        resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt);
-        upsertDetectedConflicts(db, canonicalDetected, sameTenant, detectedAt);
-        const changedIds = rebuildConflictsWithJson(db, sameTenant);
-        db.exec('COMMIT');
+        const changedIds = writeConflictRefresh(db, readConflictRefresh(db), detected, detectedAt);
         syncChangedMirrors(hippoRoot, db, [...selectEntriesByIds(db, changedIds).values()]);
     }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch {
-            // Ignore nested rollback failures.
-        }
-        throw error;
-    }
     finally {
         closeHippoDb(db);
     }
 }
-function loadSameTenantCheck(db) {
-    // Tenant guard (E2): a conflict is meaningful only within one tenant.
-    // Build id -> tenant_id once and skip cross-tenant pairs both when
-    // inserting rows and when rebuilding conflicts_with_json, so a stale
-    // cross-tenant row can neither persist nor leak a foreign id.
+/** The refresh's read of the whole memories table, kept out of the write lock because it grows with the store. */
+export function readConflictRefresh(db) {
+    // Tenant guard (E2): a conflict is meaningful only within one tenant, so cross-tenant pairs are
+    // skipped on insert and on rebuild, and a stale cross-tenant row can neither persist nor leak a foreign id.
     const tenantById = new Map();
-    // SAFETY: rows' shape matches the two columns named in the SELECT below.
-    for (const r of db.prepare(`SELECT id, tenant_id FROM memories`).all()) {
+    const storedRefs = new Map();
+    // SAFETY: rows' shape matches the three columns named in the SELECT.
+    for (const r of db.prepare(`SELECT id, tenant_id, conflicts_with_json FROM memories`).all()) {
         tenantById.set(r.id, r.tenant_id);
+        if (r.conflicts_with_json !== '[]')
+            storedRefs.set(r.id, r.conflicts_with_json);
     }
-    return (a, b) => {
+    const sameTenant = (a, b) => {
         const ta = tenantById.get(a);
         const tb = tenantById.get(b);
         return ta !== undefined && tb !== undefined && ta === tb;
     };
+    return { sameTenant, storedRefs };
+}
+/** Under the write lock: the memory_conflicts rows, then each memory whose refs change; returns the ids it rewrote. */
+export function writeConflictRefresh(db, reads, detected, detectedAt) {
+    const canonicalDetected = detected.map((conflict) => ({
+        ...canonicalConflictPair(conflict.memory_a_id, conflict.memory_b_id),
+        reason: conflict.reason,
+        score: conflict.score,
+    }));
+    db.exec('BEGIN IMMEDIATE');
+    try {
+        resolveStaleOpenConflicts(db, canonicalDetected, reads.sameTenant, detectedAt);
+        upsertDetectedConflicts(db, canonicalDetected, reads.sameTenant, detectedAt);
+        const changedIds = rebuildConflictsWithJson(db, reads);
+        db.exec('COMMIT');
+        return changedIds;
+    }
+    catch (error) {
+        if (db.isTransaction !== false)
+            db.exec('ROLLBACK');
+        throw error;
+    }
 }
 function resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt) {
     const detectedKeys = new Set(canonicalDetected.map((conflict) => `${conflict.memory_a_id}::${conflict.memory_b_id}`));
@@ -156,7 +175,7 @@ function upsertDetectedConflicts(db, canonicalDetected, sameTenant, detectedAt)
     }
 }
 /** Rewrites only the rows whose conflicts_with_json changes, and returns their ids. */
-function rebuildConflictsWithJson(db, sameTenant) {
+function rebuildConflictsWithJson(db, { sameTenant, storedRefs }) {
     // SAFETY: openConflicts' shape matches the two columns named above.
     const openConflicts = db.prepare(`
     SELECT memory_a_id, memory_b_id
@@ -176,16 +195,16 @@ function rebuildConflictsWithJson(db, sameTenant) {
         refMap.get(row.memory_a_id).add(row.memory_b_id);
         refMap.get(row.memory_b_id).add(row.memory_a_id);
     }
-    // SAFETY: memoryRows' shape matches the two columns selected below.
-    const memoryRows = db.prepare(`SELECT id, conflicts_with_json FROM memories`).all();
-    const update = db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?`);
+    // Only a row holding refs, or due some, can change. Compare-and-set, so a writer since the read keeps its value and the next sleep redoes the row.
+    const update = db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ? AND conflicts_with_json IS ?`);
     const changedIds = [];
-    for (const memory of memoryRows) {
-        const refsJson = JSON.stringify(Array.from(refMap.get(memory.id) ?? []).sort());
-        if (memory.conflicts_with_json === refsJson)
+    for (const id of new Set([...storedRefs.keys(), ...refMap.keys()])) {
+        const stored = storedRefs.has(id) ? storedRefs.get(id) ?? null : '[]';
+        const refsJson = JSON.stringify(Array.from(refMap.get(id) ?? []).sort());
+        if (stored === refsJson)
             continue;
-        update.run(refsJson, memory.id);
-        changedIds.push(memory.id);
+        if (Number(update.run(refsJson, id, stored).changes ?? 0) > 0)
+            changedIds.push(id);
     }
     return changedIds;
 }
@@ -228,7 +247,7 @@ export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = fal
                 : null;
         if (!loserId)
             return null;
-        db.exec('BEGIN');
+        db.exec('BEGIN IMMEDIATE');
         // Mark conflict as resolved
         db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = datetime('now') WHERE id = ?`)
             .run(conflictId);
@@ -297,10 +316,10 @@ function removeConflictLoser(db, t) {
         extraRemovedRawIds: [],
     };
     const { loserId, opts } = t;
-    // SAFETY: loserRow's shape matches the three columns named in the
+    // SAFETY: loserRow's shape matches the four columns named in the
     // SELECT above.
     const loserRow = db
-        .prepare(`SELECT kind, content, tenant_id FROM memories WHERE id = ?${t.scope.memScope}`)
+        .prepare(`SELECT kind, content, tenant_id, scope FROM memories WHERE id = ?${t.scope.memScope}`)
         .get(loserId, ...t.scope.memArgs);
     if (loserRow) {
         const actor = opts?.rejectedBy ?? 'cli';
@@ -323,6 +342,9 @@ function removeConflictLoser(db, t) {
 }
 /** Tombstones the loser's digest and removes its same-tenant duplicates into `removal`; returns the digest. */
 function tombstoneLoserValue(db, t, loserRow, who, removal) {
+    if (isPersonalScope(loserRow.scope)) {
+        throw new BadRequestError(`cannot reject the value of personal memory ${t.loserId}: a rejection reaches the whole tenant, so its reason would show to everyone; resolve with forget instead`);
+    }
     const { actor, reason } = who;
     const rejectedDigest = rejectionDigest(loserRow.content);
     insertRejectedValue(db, {
@@ -347,14 +369,16 @@ function tombstoneLoserValue(db, t, loserRow, who, removal) {
     // to keep it in this same resolution, and this branch must not
     // undo that choice in the same transaction.
     const loserTenantId = loserRow.tenant_id ?? 'default';
-    // SAFETY: dupRows' shape matches the three columns named in the
-    // SELECT above.
+    // SAFETY: dupRows' shape matches the four columns named in the SELECT above.
     const dupRows = db
-        .prepare(`SELECT id, kind, content FROM memories WHERE tenant_id = ? AND id != ? AND id != ?`)
+        .prepare(`SELECT id, kind, content, scope FROM memories WHERE tenant_id = ? AND id != ? AND id != ?`)
         .all(loserTenantId, t.loserId, t.keepId);
     for (const dup of dupRows) {
         if (rejectionDigest(dup.content) !== rejectedDigest)
             continue;
+        // Another person's personal row is outside this resolver's reach, as it is outside their recall.
+        if (isPersonalScope(dup.scope) && dup.scope !== loserRow.scope)
+            continue;
         if (dup.kind === 'raw') {
             archiveRawMemory(db, dup.id, { reason, who: actor });
             removal.extraRemovedRawIds.push(dup.id);

package/dist/store/delete-and-batch.d.ts

@@ -5,6 +5,8 @@ import { type DormantMove } from '../dormant.js';
 export declare const MEMORY_BACKED_TABLES: readonly ["predictions", "decisions", "incidents", "processes", "policies", "skills", "project_briefs", "customer_notes"];
 /** Ids of memories that back a first-class object, for passes that plan deletes before making them. A table missing from an older schema is skipped. */
 export declare function memoriesBackingObjects(hippoRoot: string): Set<string>;
+/** memoriesBackingObjects on the caller's handle. */
+export declare function memoriesBackingObjectsOn(db: DatabaseSyncLike): Set<string>;
 /**
  * db-scoped delete core, so a delete can compose inside a caller's transaction.
  * NO filesystem I/O: the caller's transaction may still roll back, and mirrors are written post-commit.
@@ -46,7 +48,7 @@ export declare function deleteEntryOn(db: DatabaseSyncLike, hippoRoot: string, i
     reason?: string;
     automatic?: boolean;
 }): boolean;
-/** Consolidation's flush, one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
+/** Writes, deletes and dormant moves in one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
  *  the fields the caller changed, takes the rest from the live row, and never resurrects a row that is gone.
  *
  *  `dormant` (src/dormant.ts): each move's snapshot is inserted into `dormant_memories` and its `memories` row
@@ -57,4 +59,26 @@ export declare function batchWriteAndDelete(hippoRoot: string, toWrite: MemoryEn
     snapshot?: ReadonlyMap<string, MemoryEntry>;
     dormant?: DormantMove[];
 }): string[];
+/** Ops that must commit in one transaction, so a flush split across several never lands part of one. */
+export interface FlushComponent {
+    writes: readonly MemoryEntry[];
+    deletes: readonly string[];
+    dormant: readonly DormantMove[];
+}
+/** Tags a flush error with the ids of the component it stopped at, for the partial sleep audit row; the first tag wins. */
+export declare function noteFailedUnit(err: Error, component: FlushComponent | undefined): void;
+/** The ids noteFailedUnit tagged `err` with, if a flush threw it. */
+export declare function failedUnitOf(err: Error | null): string[] | undefined;
+/** batchWriteAndDelete on the caller's open store from component `from`, each component whole, closing the transaction at the
+ *  first component boundary after `holdMs`. Returns the next component's index and the ids that left `memories`. */
+export declare function batchWriteAndDeleteOn(db: DatabaseSyncLike, hippoRoot: string, components: readonly FlushComponent[], from: number, opts: {
+    snapshot?: ReadonlyMap<string, MemoryEntry>;
+    holdMs: number;
+    clock?: () => number;
+}): FlushChunk;
+/** Where the next transaction starts, and the ids this one removed from `memories`. */
+export interface FlushChunk {
+    next: number;
+    removedIds: string[];
+}
 //# sourceMappingURL=delete-and-batch.d.ts.map