hippo-memory 1.63.1 → 1.64.0

package/dist/store/delete-and-batch.js

@@ -6,35 +6,40 @@ import { insertDormantRow } from '../dormant.js';
 import { log } from '../log.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
 import { audit } from './audit-event.js';
-import { deleteFtsRow, stampOriginProject, upsertEntryRow } from './entry-row.js';
+import { deleteFtsRow, replaceFtsRows, stampOriginProject, upsertMemoryRow } from './entry-row.js';
 import { purgeMirrorBestEffort, mirrorBestEffort, writeMarkdownMirror } from './mirrors.js';
 import { openStore } from './open.js';
+import { clock } from '../write-budget.js';
 /** Tables whose rows keep a first-class object's backing memory in `memory_id` (ON DELETE SET NULL); tests/dormant-memories.test.ts pins it to the schema. */
 export const MEMORY_BACKED_TABLES = ['predictions', 'decisions', 'incidents', 'processes', 'policies', 'skills', 'project_briefs', 'customer_notes'];
 /** Deleting a memory that backs an object nulls the object's link, and no restore can repair it, so no automatic pass may. */
 const AUTOMATIC_DELETE_SQL = `${AUTO_DELETABLE_SQL}${MEMORY_BACKED_TABLES.map((t) => ` AND NOT EXISTS (SELECT 1 FROM ${t} WHERE ${t}.memory_id = memories.id)`).join('')}`;
 /** Ids of memories that back a first-class object, for passes that plan deletes before making them. A table missing from an older schema is skipped. */
 export function memoriesBackingObjects(hippoRoot) {
-    const ids = new Set();
     const db = openHippoDb(hippoRoot);
     try {
-        for (const table of MEMORY_BACKED_TABLES) {
-            try {
-                // SAFETY: SELECT of one nullable TEXT column, filtered to non-null.
-                const rows = db.prepare(`SELECT memory_id FROM ${table} WHERE memory_id IS NOT NULL`).all();
-                for (const r of rows)
-                    ids.add(r.memory_id);
-            }
-            catch (err) {
-                // A missing table is an older schema; any other error could hide a backing memory, so the caller stops.
-                if (!(err instanceof Error && err.message.includes('no such table')))
-                    throw err;
-            }
-        }
+        return memoriesBackingObjectsOn(db);
     }
     finally {
         closeHippoDb(db);
     }
+}
+/** memoriesBackingObjects on the caller's handle. */
+export function memoriesBackingObjectsOn(db) {
+    const ids = new Set();
+    for (const table of MEMORY_BACKED_TABLES) {
+        try {
+            // SAFETY: SELECT of one nullable TEXT column, filtered to non-null.
+            const rows = db.prepare(`SELECT memory_id FROM ${table} WHERE memory_id IS NOT NULL`).all();
+            for (const r of rows)
+                ids.add(r.memory_id);
+        }
+        catch (err) {
+            // A missing table is an older schema; any other error could hide a backing memory, so the caller stops.
+            if (!(err instanceof Error && err.message.includes('no such table')))
+                throw err;
+        }
+    }
     return ids;
 }
 /**
@@ -117,7 +122,7 @@ function mergeOwnChanges(base, ours, live) {
     }
     return row;
 }
-/** Consolidation's flush, one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
+/** Writes, deletes and dormant moves in one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
  *  the fields the caller changed, takes the rest from the live row, and never resurrects a row that is gone.
  *
  *  `dormant` (src/dormant.ts): each move's snapshot is inserted into `dormant_memories` and its `memories` row
@@ -125,77 +130,120 @@ function mergeOwnChanges(base, ours, live) {
  *  is never in both places or in neither. Deletes and moves both skip rows that are no longer auto-deletable
  *  (pinned, raw, kept for good or backing an object since the caller decided). Returns the ids that left `memories`, deleted or moved. */
 export function batchWriteAndDelete(hippoRoot, toWrite, toDeleteIds, opts) {
-    const dormantMoves = opts?.dormant ?? [];
-    if (toWrite.length === 0 && toDeleteIds.length === 0 && dormantMoves.length === 0)
+    const dormant = opts?.dormant ?? [];
+    if (toWrite.length === 0 && toDeleteIds.length === 0 && dormant.length === 0)
         return [];
     const db = openStore(hippoRoot);
     try {
-        // IMMEDIATE: the tombstone probes below read before the first write, and under a deferred BEGIN a
-        // concurrent `hippo reject` would make the lock upgrade fail with SQLITE_BUSY and roll back the batch.
-        db.exec('BEGIN IMMEDIATE');
-        // Snapshot every doomed row's dag_parent_id before the deletes: consolidation flushes through here
-        // every cycle, so without it parents would never be marked dirty for decay, merge or garbage-collect.
-        const dirty = { parents: new Set(), tenantById: new Map() };
-        const deletableIds = [];
-        if (toDeleteIds.length > 0) {
-            // A row pinned after the caller decided to delete it survives.
-            for (const row of selectAutoDeletableRows(db, toDeleteIds, dirty))
-                deletableIds.push(row.id);
-        }
-        // v39: batch writers bypass writeEntry, so stamp store-derived origins here too (a NULL origin hides new
-        // memories from ambient context). A row queued twice keeps only its last version, the one the merge compares.
-        const stampedWrites = [...new Map(toWrite.map((e) => [e.id, stampOriginProject(hippoRoot, e)])).values()];
-        const { written, batchRejectedSkips } = applyBatchWrites(db, stampedWrites, opts?.snapshot, dirty);
-        const removedIds = moveDormantAndDelete(db, dormantMoves, deletableIds, dirty);
+        // One component, so every op keeps the statement order this call has always had.
+        const all = { writes: toWrite, deletes: toDeleteIds, dormant };
+        return batchWriteAndDeleteOn(db, hippoRoot, [all], 0, { snapshot: opts?.snapshot, holdMs: Infinity }).removedIds;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+const failedUnits = new WeakMap();
+/** Tags a flush error with the ids of the component it stopped at, for the partial sleep audit row; the first tag wins. */
+export function noteFailedUnit(err, component) {
+    if (!component || failedUnits.has(err))
+        return;
+    const ids = [...component.writes.map((e) => e.id), ...component.deletes, ...component.dormant.map((m) => m.entry.id)];
+    failedUnits.set(err, [...new Set(ids)]);
+}
+/** The ids noteFailedUnit tagged `err` with, if a flush threw it. */
+export function failedUnitOf(err) {
+    return err ? failedUnits.get(err) : undefined;
+}
+/** batchWriteAndDelete on the caller's open store from component `from`, each component whole, closing the transaction at the
+ *  first component boundary after `holdMs`. Returns the next component's index and the ids that left `memories`. */
+export function batchWriteAndDeleteOn(db, hippoRoot, components, from, opts) {
+    const now = opts.clock ?? clock;
+    // IMMEDIATE: the tombstone probes below read before the first write, and under a deferred BEGIN a
+    // concurrent `hippo reject` would make the lock upgrade fail with SQLITE_BUSY and roll back the batch.
+    db.exec('BEGIN IMMEDIATE');
+    const begunAt = now();
+    const out = { written: [], removedIds: [], rejectedSkips: 0, fts: { rows: [], staleIds: [] }, dirty: { parents: new Set(), tenantById: new Map() } };
+    let next = from;
+    try {
+        do {
+            const at = next++;
+            try {
+                applyComponent(db, hippoRoot, components[at], opts.snapshot, out);
+            }
+            catch (err) {
+                if (err instanceof Error)
+                    noteFailedUnit(err, components[at]);
+                throw err;
+            }
+        } while (next < components.length && now() - begunAt < opts.holdMs);
+        const removed = new Set(out.removedIds);
+        replaceFtsRows(db, out.fts.rows.filter((row) => !removed.has(row.id)), [...out.fts.staleIds, ...out.removedIds]);
         // Fire dirty-mark for every collected parent INSIDE the BEGIN, so the
         // dirty flag commits atomically with the writes + deletes.
-        for (const parentId of dirty.parents) {
-            markSummaryDirtyInTx(db, parentId, dirty.tenantById.get(parentId) ?? 'default', 'batch');
+        for (const parentId of out.dirty.parents) {
+            markSummaryDirtyInTx(db, parentId, out.dirty.tenantById.get(parentId) ?? 'default', 'batch');
         }
         db.exec('COMMIT');
-        if (batchRejectedSkips > 0) {
-            log.warn(`batchWriteAndDelete: skipped ${batchRejectedSkips} write(s) whose content matches a rejected value (tombstone hit during the batch transaction)`);
-        }
-        // Sync mirrors once after all DB writes. Entries skipped above were
-        // never inserted — writing their markdown mirror would resurrect the
-        // exact content the skip just kept out of the DB.
-        mirrorBestEffort('markdown mirrors', () => {
-            for (const entry of written)
-                writeMarkdownMirror(hippoRoot, entry);
-        });
-        for (const id of removedIds)
-            purgeMirrorBestEffort(hippoRoot, id, false, 'batchWriteAndDelete');
-        return removedIds;
     }
     catch (error) {
-        try {
-            db.exec('ROLLBACK');
+        if (db.isTransaction !== false) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { /* preserve the original throw and its unit tag */ }
         }
-        catch { /* ignore */ }
         throw error;
     }
-    finally {
-        closeHippoDb(db);
+    reportChunk(hippoRoot, out);
+    return { next, removedIds: out.removedIds };
+}
+/** One component in the open transaction, in the order a single batch always ran: pin-checked deletes, writes, dormant moves, row deletes. */
+function applyComponent(db, hippoRoot, component, snapshot, out) {
+    // Snapshot every doomed row's dag_parent_id before the deletes: consolidation flushes through here
+    // every cycle, so without it parents would never be marked dirty for decay, merge or garbage-collect.
+    const deletableIds = [];
+    if (component.deletes.length > 0) {
+        // A row pinned after the caller decided to delete it survives.
+        for (const row of selectAutoDeletableRows(db, component.deletes, out.dirty))
+            deletableIds.push(row.id);
+    }
+    // v39: batch writers bypass writeEntry, so stamp store-derived origins here too (a NULL origin hides new
+    // memories from ambient context). A row queued twice keeps only its last version, the one the merge compares.
+    const stampedWrites = [...new Map(component.writes.map((e) => [e.id, stampOriginProject(hippoRoot, e)])).values()];
+    applyBatchWrites(db, stampedWrites, snapshot, out);
+    moveDormantAndDelete(db, component.dormant, deletableIds, out);
+}
+/** After COMMIT: warn about refused writes, then sync mirrors once for what landed. */
+function reportChunk(hippoRoot, out) {
+    if (out.rejectedSkips > 0) {
+        log.warn(`batchWriteAndDelete: skipped ${out.rejectedSkips} write(s) whose content matches a rejected value (tombstone hit during the batch transaction)`);
     }
+    // A skipped write never landed, so mirroring it would resurrect the text the skip kept out of the DB.
+    mirrorBestEffort('markdown mirrors', () => {
+        for (const entry of out.written)
+            writeMarkdownMirror(hippoRoot, entry);
+    });
+    for (const id of out.removedIds)
+        purgeMirrorBestEffort(hippoRoot, id, false, 'batchWriteAndDelete');
 }
-/** Moves eligible dormant rows out, deletes them with the doomed rows, and returns every removed id. */
-function moveDormantAndDelete(db, dormantMoves, deletableIds, dirty) {
+/** Moves eligible dormant rows out, then deletes them with the doomed rows, recording every removed id. */
+function moveDormantAndDelete(db, dormantMoves, deletableIds, out) {
     // Dormant moves: same eligibility and DAG bookkeeping as deletes.
     const movable = [];
     if (dormantMoves.length > 0) {
         const byId = new Map(dormantMoves.map((m) => [m.entry.id, m]));
-        for (const row of selectAutoDeletableRows(db, [...byId.keys()], dirty))
+        for (const row of selectAutoDeletableRows(db, [...byId.keys()], out.dirty))
             movable.push(byId.get(row.id));
     }
     for (const move of movable) {
         insertDormantRow(db, move);
     }
-    const removedIds = [...deletableIds, ...movable.map((m) => m.entry.id)];
-    for (const id of removedIds) {
-        db.prepare('DELETE FROM memories WHERE id = ?').run(id);
-        deleteFtsRow(db, id);
+    const deleteRow = db.prepare('DELETE FROM memories WHERE id = ?');
+    for (const id of [...deletableIds, ...movable.map((m) => m.entry.id)]) {
+        deleteRow.run(id);
+        out.removedIds.push(id);
     }
-    return removedIds;
 }
 /** The still auto-deletable rows among `ids`, recording each one's DAG parent as dirty. Placeholders come from `ids` itself. */
 function selectAutoDeletableRows(db, ids, dirty) {
@@ -209,11 +257,10 @@ function selectAutoDeletableRows(db, ids, dirty) {
     }
     return rows;
 }
-function applyBatchWrites(db, stampedWrites, snapshot, dirty) {
+function applyBatchWrites(db, stampedWrites, snapshot, out) {
     // Probe tombstones per entry on THIS connection inside the transaction: the producer's check ran earlier
     // on another connection, so a reject committed in between would be re-inserted. Skip, never throw, so the rest lands.
-    let batchRejectedSkips = 0;
-    const written = [];
+    const { written, fts, dirty } = out;
     const readLiveRow = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id = ?`);
     for (const entry of stampedWrites) {
         const base = snapshot?.get(entry.id);
@@ -222,7 +269,7 @@ function applyBatchWrites(db, stampedWrites, snapshot, dirty) {
         const live = liveRow ? rowToEntry(liveRow) : undefined;
         const row = base && live ? mergeOwnChanges(base, entry, live) : entry;
         if (isRejectedBatchWrite(db, row)) {
-            batchRejectedSkips++;
+            out.rejectedSkips++;
             continue;
         }
         if (base && !live)
@@ -230,14 +277,19 @@ function applyBatchWrites(db, stampedWrites, snapshot, dirty) {
         written.push(row);
         // Bypass the guard: merges concatenate already-guarded facts, the merge pass checks merged content, and
         // the probe above closes the race; a mid-batch refusal would abort the whole consolidation.
-        upsertEntryRow(db, row, true);
+        upsertMemoryRow(db, row);
+        // A decay refresh changes no indexed text, and re-indexing it would cost a full index scan per row.
+        if (!live || row.content !== live.content || row.tags.join(' ') !== live.tags.join(' ')) {
+            fts.rows.push(row);
+            if (live)
+                fts.staleIds.push(row.id);
+        }
         // Hook for writes: a new child, or a change to what its summary reads, marks the parent dirty; decay alone does not.
         if (row.dag_parent_id && (!live || SUMMARY_INPUTS.some((k) => row[k] !== live[k]))) {
             dirty.parents.add(row.dag_parent_id);
             dirty.tenantById.set(row.dag_parent_id, row.tenantId);
         }
     }
-    return { written, batchRejectedSkips };
 }
 /** True, after auditing the refusal, when the write would introduce a rejected value. */
 function isRejectedBatchWrite(db, row) {

package/dist/store/entry-reads.d.ts

@@ -32,7 +32,7 @@ export declare function loadEntriesByIds(hippoRoot: string, ids: readonly string
  *
  * Returns `[]` for an empty sessionId. Final order: `created ASC, id ASC`.
  */
-export declare function loadSessionRawMemories(hippoRoot: string, sessionId: string, tenantId?: string, cap?: number): MemoryEntry[];
+export declare function loadSessionRawMemories(hippoRoot: string, sessionId: string, tenantId?: string, cap?: number, origins?: readonly string[]): MemoryEntry[];
 /**
  * Pre-cap, scope-aware row count for a session. Lets `assemble` report
  * the full session size even when `rowCap` truncates the loaded window,
@@ -41,13 +41,12 @@ export declare function loadSessionRawMemories(hippoRoot: string, sessionId: str
  * An unscoped COUNT would let a no-scope caller infer private rows by comparing `totalRaw`
  * against `items.length`, so this SQL-encodes the default-deny rule `passesScopeFilterForRecall` applies in TS:
  *   - explicit scope passed: exact-match
- *   - no scope: rows where scope IS NULL, or scope is NOT a `<source>:private:*`
- *     pattern AND not the `unknown:legacy` quarantine bucket.
+ *   - no scope: `scopeAdmitSql`'s default deny, which admits `ownScope`, the caller's personal scope.
  *
  * `tenantId` is optional for back-compat. Pass `undefined` only when
  * intentionally counting cross-tenant; `assemble()` passes `ctx.tenantId`.
  */
-export declare function countSessionRawMemories(hippoRoot: string, sessionId: string, tenantId?: string, scope?: string): number;
+export declare function countSessionRawMemories(hippoRoot: string, sessionId: string, tenantId?: string, scope?: string, ownScope?: string, origins?: readonly string[]): number;
 /**
  * Last N kind='raw' memories by `created` desc. Tenant scoped. When
  * `sessionId` is supplied, also constrains to a specific session — that
@@ -62,7 +61,7 @@ export declare function countSessionRawMemories(hippoRoot: string, sessionId: st
  * The tenant-wide shape is the back-compat default but discouraged; `api.recall` throws
  * `RecallContractError` for it when `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set.
  */
-export declare function loadFreshRawMemories(hippoRoot: string, count: number, tenantId?: string, sessionId?: string): MemoryEntry[];
+export declare function loadFreshRawMemories(hippoRoot: string, count: number, tenantId?: string, sessionId?: string, origins?: readonly string[]): MemoryEntry[];
 /**
  * Direct DAG children of a parent summary. Tenant scoped. Returns only rows
  * whose `dag_parent_id` matches `parentId`; does NOT walk recursively.
@@ -80,5 +79,5 @@ export declare function loadAllEntries(hippoRoot: string, tenantId?: string): Me
 export declare function selectAllEntries(db: DatabaseSyncLike, tenantId?: string): MemoryEntry[];
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export declare function selectLiveEntriesBySourcePrefix(db: DatabaseSyncLike, tenantId: string, prefix: string): MemoryEntry[];
-export declare function loadContentsWithTag(hippoRoot: string, tenantId: string, tag: string): string[];
+export declare function loadContentsWithTag(hippoRoot: string, tenantId: string, tag: string, origins?: readonly string[]): string[];
 //# sourceMappingURL=entry-reads.d.ts.map

package/dist/store/entry-reads.js

@@ -2,6 +2,8 @@ import { closeHippoDb } from '../db.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { openStore } from './open.js';
 import { escapeLike } from '../escape.js';
+import { originInSql } from '../project-identity.js';
+import { scopeAdmitSql } from '../recall-scope.js';
 /**
  * Read a memory entry by ID.
  *
@@ -91,6 +93,9 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
         closeHippoDb(db);
     }
 }
+function originClause(origins) {
+    return origins === undefined ? '' : ` AND (origin_project = '' OR ${originInSql(origins)})`;
+}
 /**
  * All `kind='raw'` rows for a given session, tenant-scoped, returned
  * oldest-first. Used by `api.assemble` to walk a session's chronological
@@ -101,7 +106,7 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
  *
  * Returns `[]` for an empty sessionId. Final order: `created ASC, id ASC`.
  */
-export function loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap) {
+export function loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap, origins) {
     if (!sessionId)
         return [];
     const db = openStore(hippoRoot);
@@ -113,6 +118,8 @@ export function loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap) {
             sql += ' AND tenant_id = ?';
             params.push(tenantId);
         }
+        sql += originClause(origins);
+        params.push(...(origins ?? []));
         if (cap !== undefined && cap > 0) {
             sql += ' ORDER BY created DESC, id DESC LIMIT ?';
             params.push(cap);
@@ -137,13 +144,12 @@ export function loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap) {
  * An unscoped COUNT would let a no-scope caller infer private rows by comparing `totalRaw`
  * against `items.length`, so this SQL-encodes the default-deny rule `passesScopeFilterForRecall` applies in TS:
  *   - explicit scope passed: exact-match
- *   - no scope: rows where scope IS NULL, or scope is NOT a `<source>:private:*`
- *     pattern AND not the `unknown:legacy` quarantine bucket.
+ *   - no scope: `scopeAdmitSql`'s default deny, which admits `ownScope`, the caller's personal scope.
  *
  * `tenantId` is optional for back-compat. Pass `undefined` only when
  * intentionally counting cross-tenant; `assemble()` passes `ctx.tenantId`.
  */
-export function countSessionRawMemories(hippoRoot, sessionId, tenantId, scope) {
+export function countSessionRawMemories(hippoRoot, sessionId, tenantId, scope, ownScope, origins) {
     if (!sessionId)
         return 0;
     const db = openStore(hippoRoot);
@@ -155,14 +161,16 @@ export function countSessionRawMemories(hippoRoot, sessionId, tenantId, scope) {
             sql += ' AND tenant_id = ?';
             params.push(tenantId);
         }
+        sql += originClause(origins);
+        params.push(...(origins ?? []));
         if (scope !== undefined && scope !== '') {
             sql += ' AND scope = ?';
             params.push(scope);
         }
         else {
-            // SQL-ify the TS default-deny: scope IS NULL OR (NOT LIKE '%:private:%'
-            // AND != 'unknown:legacy'). Mirrors api.passesScopeFilterForRecall.
-            sql += ` AND (scope IS NULL OR (scope NOT LIKE '%:private:%' AND scope != 'unknown:legacy'))`;
+            const admit = scopeAdmitSql('', ownScope);
+            sql += ` AND ${admit.sql}`;
+            params.push(...admit.params);
         }
         // SAFETY: row's shape matches the single `COUNT(*) AS c` column above.
         const row = db.prepare(sql).get(...params);
@@ -186,7 +194,7 @@ export function countSessionRawMemories(hippoRoot, sessionId, tenantId, scope) {
  * The tenant-wide shape is the back-compat default but discouraged; `api.recall` throws
  * `RecallContractError` for it when `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set.
  */
-export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId) {
+export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId, origins) {
     if (count <= 0)
         return [];
     const capped = Math.min(count, 200);
@@ -202,6 +210,8 @@ export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId) {
             sql += ' AND source_session_id = ?';
             params.push(sessionId);
         }
+        sql += originClause(origins);
+        params.push(...(origins ?? []));
         // Tie tail makes same-`created` rows deterministic; `content` before `id` because ids are random
         // UUIDs, so an id-only tail would pick which same-created rows make the window per instance.
         sql += ' ORDER BY created DESC, content ASC, id ASC LIMIT ?';
@@ -258,13 +268,15 @@ export function selectLiveEntriesBySourcePrefix(db, tenantId, prefix) {
     const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE tenant_id = ? AND superseded_by IS NULL AND source LIKE ? ESCAPE '\\'`).all(tenantId, `${escapeLike(prefix)}%`);
     return rows.map(rowToEntry).filter((entry) => entry.source.startsWith(prefix));
 }
-// Content of every tenant row tagged `tag`, without reading the rest of the store.
-// `instr` is a substring prefilter over the raw JSON; `includes` below re-checks exactly.
-export function loadContentsWithTag(hippoRoot, tenantId, tag) {
+// Content of every team-visible tenant row tagged `tag`, without reading the rest of the store; `origins` keeps one project's rows and user-global ones.
+// No owner: a personal or connector-private row must never answer `duplicate` for, or stop, a team copy. `instr` prefilters; `includes` re-checks.
+export function loadContentsWithTag(hippoRoot, tenantId, tag, origins) {
     const db = openStore(hippoRoot);
     try {
+        const inProject = origins === undefined ? '' : ` AND (origin_project = '' OR ${originInSql(origins)})`;
+        const admit = scopeAdmitSql('');
         /** SAFETY: rows' shape matches the two columns named in the SELECT below. */
-        const rows = db.prepare(`SELECT content, tags_json FROM memories WHERE tenant_id = ? AND instr(tags_json, ?) > 0`).all(tenantId, JSON.stringify(tag));
+        const rows = db.prepare(`SELECT content, tags_json FROM memories WHERE tenant_id = ? AND instr(tags_json, ?) > 0${inProject} AND ${admit.sql}`).all(tenantId, JSON.stringify(tag), ...(origins ?? []), ...admit.params);
         return rows.filter((r) => parseJsonArray(r.tags_json).includes(tag)).map((r) => r.content);
     }
     finally {

package/dist/store/entry-row.d.ts

@@ -1,12 +1,12 @@
 import type { MemoryEntry } from '../memory.js';
 import { openHippoDb } from '../db.js';
-/**
- * `bypassRejectionGuard`: ONLY `batchWriteAndDelete` passes `true`; its merges concatenate
- * already-guarded facts, and it re-probes tombstones in-transaction before each upsert.
- */
-export declare function upsertEntryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, bypassRejectionGuard?: boolean): void;
+export declare function upsertEntryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry): void;
+/** The row alone, with no rejection guard or full-text row, for `upsertEntryRow` and for `batchWriteAndDelete`, which probes tombstones and indexes per batch. Returns whether the row is new. */
+export declare function upsertMemoryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry): boolean;
 export declare function syncFtsRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, isNewRow?: boolean): void;
 export declare function deleteFtsRow(db: ReturnType<typeof openHippoDb>, id: string): void;
+/** One set delete for `staleIds`, because `id` is UNINDEXED and each delete by id scans the whole index; then one insert per row. */
+export declare function replaceFtsRows(db: ReturnType<typeof openHippoDb>, rows: readonly MemoryEntry[], staleIds: readonly string[]): void;
 /**
  * Write a memory entry to SQLite and refresh compatibility mirrors.
  *
@@ -29,11 +29,8 @@ export declare function deleteFtsRow(db: ReturnType<typeof openHippoDb>, id: str
  * origin (shareMemory, syncGlobalToLocal) set entry.origin_project before
  * writing and this is a no-op. Returns a stamped copy; never mutates.
  *
- * NULL is deliberately PRESERVED, not re-stamped: null means "legacy row the
- * v39 migration found no evidence for" and is deny-by-default in ambient
- * context. A writeback (e.g. markRetrieved on a crossProject-included row)
- * must not launder it into an injectable origin - the migration is the only
- * evidence-based NULL converter.
+ * NULL is PRESERVED, not re-stamped: it means no known project (a legacy row with no evidence, or a write to a
+ * shared store that named none) and ambient context denies it, so a writeback must not launder it.
  */
 export declare function stampOriginProject(hippoRoot: string, entry: MemoryEntry): MemoryEntry;
 /**

package/dist/store/entry-row.js

@@ -1,19 +1,16 @@
-import * as path from 'path';
 import { isFtsAvailable } from '../db.js';
-import { deriveOriginProject, originFromSource } from '../project-identity.js';
+import { fallbackOrigin, originFromSource } from '../project-identity.js';
 import { checkRejectionGuard } from '../rejection.js';
 import { log } from '../log.js';
-/**
- * `bypassRejectionGuard`: ONLY `batchWriteAndDelete` passes `true`; its merges concatenate
- * already-guarded facts, and it re-probes tombstones in-transaction before each upsert.
- */
-export function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
-    if (!bypassRejectionGuard) {
-        checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
-    }
+export function upsertEntryRow(db, entry) {
+    checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
+    syncFtsRow(db, entry, upsertMemoryRow(db, entry));
+}
+/** The row alone, with no rejection guard or full-text row, for `upsertEntryRow` and for `batchWriteAndDelete`, which probes tombstones and indexes per batch. Returns whether the row is new. */
+export function upsertMemoryRow(db, entry) {
     const isNewRow = db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(entry.id) === undefined;
     db.prepare(UPSERT_MEMORY_SQL).run(...memoryRowValues(entry));
-    syncFtsRow(db, entry, isNewRow);
+    return isNewRow;
 }
 const UPSERT_MEMORY_SQL = `
     INSERT INTO memories(
@@ -136,6 +133,34 @@ export function deleteFtsRow(db, id) {
         log.warnThenDebug('fts-delete', `FTS index delete failed for ${id}; recall may return a stale hit: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/** One set delete for `staleIds`, because `id` is UNINDEXED and each delete by id scans the whole index; then one insert per row. */
+export function replaceFtsRows(db, rows, staleIds) {
+    if (!isFtsAvailable(db))
+        return;
+    let kept = new Set();
+    if (staleIds.length > 0) {
+        try {
+            db.prepare(`DELETE FROM memories_fts WHERE id IN (SELECT value FROM json_each(?))`).run(JSON.stringify(staleIds));
+        }
+        catch (err) {
+            // Their old rows are still indexed, so inserting them again would index an id twice; only new ids go in.
+            kept = new Set(staleIds);
+            log.warnThenDebug('fts-delete', `FTS index delete failed for ${staleIds.length} row(s); recall may return a stale hit: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const toInsert = rows.filter((row) => !kept.has(row.id));
+    if (toInsert.length === 0)
+        return;
+    const insert = db.prepare(`INSERT INTO memories_fts(id, content, tags) VALUES (?, ?, ?)`);
+    for (const row of toInsert) {
+        try {
+            insert.run(row.id, row.content, row.tags.join(' '));
+        }
+        catch (err) {
+            log.warnThenDebug('fts-sync', `FTS index update failed for ${row.id}; keyword recall may miss it: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
 /**
  * Write a memory entry to SQLite and refresh compatibility mirrors.
  *
@@ -158,16 +183,13 @@ export function deleteFtsRow(db, id) {
  * origin (shareMemory, syncGlobalToLocal) set entry.origin_project before
  * writing and this is a no-op. Returns a stamped copy; never mutates.
  *
- * NULL is deliberately PRESERVED, not re-stamped: null means "legacy row the
- * v39 migration found no evidence for" and is deny-by-default in ambient
- * context. A writeback (e.g. markRetrieved on a crossProject-included row)
- * must not launder it into an injectable origin - the migration is the only
- * evidence-based NULL converter.
+ * NULL is PRESERVED, not re-stamped: it means no known project (a legacy row with no evidence, or a write to a
+ * shared store that named none) and ambient context denies it, so a writeback must not launder it.
  */
 export function stampOriginProject(hippoRoot, entry) {
     if (entry.origin_project !== undefined)
         return entry;
-    return { ...entry, origin_project: deriveOriginProject(path.dirname(hippoRoot)) };
+    return { ...entry, origin_project: fallbackOrigin(hippoRoot) };
 }
 /**
  * Import-time variant for a mirror with no origin field (an explicit null stays null): used only where evidence exists
@@ -184,7 +206,7 @@ export function stampOriginProjectForImport(hippoRoot, entry) {
     const fromSource = originFromSource(entry.source);
     return {
         ...entry,
-        origin_project: fromSource ?? deriveOriginProject(path.dirname(hippoRoot)),
+        origin_project: fromSource ?? fallbackOrigin(hippoRoot),
     };
 }
 //# sourceMappingURL=entry-row.js.map

package/dist/store/entry-writes.d.ts

@@ -10,14 +10,14 @@ export declare function writeEntry(hippoRoot: string, entry: MemoryEntry, opts?:
 /** writeEntry on the caller's open store, so a loop of writes opens the store once; each row still commits alone. */
 export declare function writeEntryOn(db: DatabaseSyncLike, hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryOptions): void;
 /**
- * DB-only write path. Caller owns the open `db` handle. Runs SAVEPOINT +
- * upsert + afterWrite hook + audit row inside the SAVEPOINT scope. Caller
+ * DB-only write path. Caller owns the open `db` handle. Runs upsert +
+ * afterWrite hook + audit row inside one withWriteScope. Caller
  * is responsible for opening `db`, optionally wrapping in a larger BEGIN/
  * COMMIT (e.g. supersede's BEGIN IMMEDIATE), closing `db`, AND calling
  * `writeEntryMirrors` after the larger tx commits — mirrors must run
  * post-commit so a rolled-back tx never leaves orphan markdown.
  *
- * Audit-order note: the audit row is emitted INSIDE the SAVEPOINT, so audit
+ * Audit-order note: the audit row is emitted INSIDE the write scope, so audit
  * commits atomically with the row INSERT. A subsequent mirror failure cannot
  * leave a recorded audit entry without its corresponding DB row. This is a
  * documented hardening over the prior writeEntry-as-monolith ordering.

package/dist/store/entry-writes.js

@@ -1,5 +1,5 @@
 import { markRetrieved } from '../memory.js';
-import { closeHippoDb, openHippoDb } from '../db.js';
+import { closeHippoDb, openHippoDb, withWriteScope } from '../db.js';
 import { RejectedValueError } from '../rejection.js';
 import { markSummaryDirtyInTx } from '../summary-dirty.js';
 import { log } from '../log.js';
@@ -26,7 +26,7 @@ export function writeEntryOn(db, hippoRoot, entry, opts) {
         writeEntryMirrors(hippoRoot, stamped);
     }
     catch (error) {
-        // writeEntryDbOnly's SAVEPOINT has already unwound here, so the refusal audit lands
+        // writeEntryDbOnly's write scope has already unwound here, so the refusal audit lands
         // post-rollback in a fresh implicit transaction; then rethrow so the caller sees it.
         if (error instanceof RejectedValueError) {
             auditRejectionRefusal(db, error, opts?.actor ?? 'cli');
@@ -35,25 +35,22 @@ export function writeEntryOn(db, hippoRoot, entry, opts) {
     }
 }
 /**
- * DB-only write path. Caller owns the open `db` handle. Runs SAVEPOINT +
- * upsert + afterWrite hook + audit row inside the SAVEPOINT scope. Caller
+ * DB-only write path. Caller owns the open `db` handle. Runs upsert +
+ * afterWrite hook + audit row inside one withWriteScope. Caller
  * is responsible for opening `db`, optionally wrapping in a larger BEGIN/
  * COMMIT (e.g. supersede's BEGIN IMMEDIATE), closing `db`, AND calling
  * `writeEntryMirrors` after the larger tx commits — mirrors must run
  * post-commit so a rolled-back tx never leaves orphan markdown.
  *
- * Audit-order note: the audit row is emitted INSIDE the SAVEPOINT, so audit
+ * Audit-order note: the audit row is emitted INSIDE the write scope, so audit
  * commits atomically with the row INSERT. A subsequent mirror failure cannot
  * leave a recorded audit entry without its corresponding DB row. This is a
  * documented hardening over the prior writeEntry-as-monolith ordering.
  */
 export function writeEntryDbOnly(db, entry, opts) {
-    // SAVEPOINT (not BEGIN) so this nests safely inside any outer transaction
-    // a caller might hold (e.g. supersede's BEGIN IMMEDIATE). SQLite refuses
-    // BEGIN within a transaction; SAVEPOINT is the only way to scope rollback
-    // without disturbing outers.
-    db.exec('SAVEPOINT write_entry');
-    try {
+    // Inside a caller's transaction (e.g. supersede's BEGIN IMMEDIATE) the scope is a SAVEPOINT,
+    // so a throw here rolls back only this write and leaves the outer open.
+    withWriteScope(db, 'write_entry', () => {
         upsertEntryRow(db, entry);
         if (opts?.afterWrite) {
             opts.afterWrite(db, entry.id);
@@ -67,18 +64,7 @@ export function writeEntryDbOnly(db, entry, opts) {
         if (entry.dag_parent_id) {
             markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenantId, opts?.actor ?? 'cli');
         }
-        db.exec('RELEASE SAVEPOINT write_entry');
-    }
-    catch (e) {
-        try {
-            db.exec('ROLLBACK TO SAVEPOINT write_entry');
-            db.exec('RELEASE SAVEPOINT write_entry');
-        }
-        catch {
-            // Ignore rollback failures — the throw below is what matters.
-        }
-        throw e;
-    }
+    });
 }
 /** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
 export function writeEntryMirrors(hippoRoot, entry) {